The anomalies command is used to look for events based on the values of a field and return only the values that you won't expect to find. As the anomalies command is running, it assigns an unexpectedness score to each event, and the event is only considered unexpected if the unexpectedness score passes the defined threshold. In the following example, we use the anomalies command to assess the bytes field within our website access logs, and we define a threshold of unexpectedness at 0.03. The table and sort commands are just to make data presentation a little bit nicer:
index=main sourcetype=access_combined | anomalies field=bytes threshold=0.03 | table unexpectedness, _raw | sort -unexpectedness
The results that are ...
