Share data in the Splunk App for Anomaly Detection

When the Splunk App for Anomaly Detection is deployed on Splunk Enterprise, the Splunk platform sends aggregated usage data to Splunk Inc. ("Splunk") to help improve the Splunk App for Anomaly Detection in future releases. For information about how to opt in or out and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

What data is collected

The Splunk App for Anomaly Detection collects the following basic usage information:

Component Description Example
app.session.schedule_clicked Information entered in the "Schedule" modal in the Job Dashboard.
JSON 
{ 
   component: app.session.schedule_clicked
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     rowData: { 
       alertExpiresTimeUnit: h
       alertExpiresValue: 24
       cronSchedule:
       description: got5 milk?
       emailTo: wdeaderick@splunk.com
       name: got5 milk?
       search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.878 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     }
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: b83a31f5-1028-6ca8-dac6-94c2985e0caa
   experienceID: 5efc3c69-0a78-611b-7c34-c641e2597d80
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678991871
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.manage_alert_clicked When a user clicks "Manage alert" in Anomaly app.
JSON 
{
    "optInRequired": 3,
    "version": "4",
    "experienceID": "dd4a1aa8-13ba-84dc-2386-0de9174cb1d9",
    "timestamp": 1678237020,
    "visibility": "anonymous,support",
    "userID": "3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc",
    "deploymentID": "c551ac66-1d97-5dc7-98ac-634bcc99ebee",
    "component": "app.session.manage_alert_clicked",
    "splunkVersion": "9.0.3",
    "eventID": "84ddf59b-5c41-1bca-03c9-490c973dfafa",
    "data": {
        "app": "Splunk_App_for_Anomaly_Detection",
        "page": "start",
        "rowData": {
            "numOfAnomConditionValue": "1",
            "confConditionSymbol": ">=",
            "confConditionValue": "0.82",
            "alertExpiresTimeUnit": "h",
            "alertExpiresValue": "24",
            "cronSchedule": "15 * * * *",
            "description": "Tel test2 desc",
            "search": "| inputlookup kpi.csv \n| dedup _time\n| sort _time\n| fit StateSpaceForecast input period=24 as preds\n| anomconfidences field_name=input pred_name=preds conf_name=anomConf\n| eval thresh = 0.878\n| eval isOutlier = if(anomConf >= thresh, 1, 0)\n| anomintervals field_name=input conf_name=anomConf anom_name=isOutlier\n| table _time, input, isOutlier, anomConf",
            "emailMsg": "The alert condition was triggered.",
            "name": "Tel test2",
            "emailSubject": "Splunk Alert: Tel test2",
            "emailTo": "dchang@splunk.com",
            "numOfAnomConditionSymbol": ">="
        },
        "source": "UI Telemetry"
    }
}
app.session.app_go_to_tab The tab ("Job Dashboard" or "Create a New Job") to which the user changed.
JSON 
{ 
   component: app.session.new_job_go_to_tab
   data: { 
     activePanelId: Create Anomaly Job
     app: Splunk_App_for_Anomaly_Detection
     page: start
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: d6e4950f-2806-a4f2-82bb-6f4268372b7f
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678908071
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.field_selected The name of the field in the user's data that was selected for anomaly detection.
JSON 
{ 
   component: app.session.field_selected
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     field: ts15
     page: start
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 198d7451-bbcc-815e-513a-5a9fd7a429d6
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678914715
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.alert_trigger_saved The information that evaluates the detected anomalies against the alerting conditions to determine whether or not an email should be sent.
JSON 
{ 
   component: app.session.alert_trigger_saved
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     data: { 
       action.email.mailserver: mail.splunk.com
       action.email.message.alert: The alert condition was triggered.
       action.email.subject: Splunk Alert: Tel test2
       action.email.to: dchang@splunk.com
       actions: email
       alert.expires: 24h
       alert_condition: | delta isOutlier as outlierDelta | eval isFirstOutlier=if(outlierDelta == 1, 1, 0) | where isFirstOutlier == 1 | eventstats count as outlierCount | sort 1 anomConf desc | stats min(anomConf) as minAnomConf by outlierCount | search outlierCount >= 1 AND minAnomConf >= 0.82
       alert_type: custom
       is_scheduled: true
       search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.878 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     }
     name: Tel test2
     page: start
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 39b03015-8009-841e-03d4-e9231847ecb3
   experienceID: dd4a1aa8-13ba-84dc-2386-0de9174cb1d9
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678237006
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.new_job_go_to_tab The tab ("Job Dashboard" or "Create a New Job") to which the user changed.
JSON 
{ 
   component: app.session.new_job_go_to_tab
   data: { 
     activePanelId: Create Anomaly Job
     app: Splunk_App_for_Anomaly_Detection
     page: start
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: d6e4950f-2806-a4f2-82bb-6f4268372b7f
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678908071
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.schedule_saved The scheduling details that the user entered for the Job execution.
JSON 
{ 
   component: app.session.schedule_saved
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     data: { 
       cron_schedule: */5 * * * *
     }
     page: start
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 9ab7237b-4f3b-7b3c-22c8-155256e2c18c
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678919796
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.new_job_saved Saving of a new job in the app.
JSON 
{ 
   component: app.session.new_job_saved
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     jobFormDetails: [ 
       { 
         label: Job Name
         value: got5 milk?
       }
       { 
         label: Job Description
         value: got5 milk?
       }
     ]
     page: start
     search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.878 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 34312936-ed61-0eb1-fe2a-e88d62e1897d
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678908197
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.delete_job_clicked User deleted a job.
JSON 
{ 
   component: app.session.delete_job_clicked
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     rowData: { 
       alertExpiresTimeUnit: h
       alertExpiresValue: 24
       cronSchedule:
       description: got4 milk?
       emailTo:
       name: got4 milk?
       search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.878 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     }
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 87e8cbd2-58c3-e775-b6cc-9df8d3b4cc90
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678910922
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.detect_anomalies_clicked User clicked on the "Detect Anomalies" button to initiate anomaly detection.
JSON 
{ 
   component: app.session.detect_anomalies_clicked
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     search: | inputlookup kpi.csv | dedup _time | sort _time | table _time input | fit AutoAnomalyDetection input
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: c2d959ca-b930-6ccc-5ec9-cf747fbd06b6
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678908083
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.sensitivity_saved The sensitivity value (low, medium, or high) selected by the user upon operationalization of the AD search.
JSON 
{ [
   component: app.session.sensitivity_saved
   data: { [
     app: Splunk_App_for_Anomaly_Detection
     page: start
     sensitivity: 2
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 42ea2afb-57c6-326c-dfcf-2b0504856947
   experienceID: ffc7e5a5-44dc-92ec-ffbd-e34b1dae7a62
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1677867058
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.create_job_open_in_search_clicked User clicked on the button to open the SPL query in search from within the "Create Job" dialog.
JSON 
{ 
   component: app.session.create_job_open_in_search_clicked
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.6681 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 87877205-355b-f3f8-2c9e-30bda02fc50e
   experienceID: ffc7e5a5-44dc-92ec-ffbd-e34b1dae7a62
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1677867086
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.view_spl_clicked User clicked on the button to open the SPL query in search from the main AD workflow UI.
JSON 
{ 
   component: app.session.view_spl_clicked
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.6681 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: 0e7f77ee-a5ad-a78b-0d7d-85079cd7265e
   experienceID: ffc7e5a5-44dc-92ec-ffbd-e34b1dae7a62
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1677867088
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.delete_job_successful Deleting a job was successful.
JSON 
{ 
   component: app.session.delete_job_successful
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     page: start
     rowData: { 
       alertExpiresTimeUnit: h
       alertExpiresValue: 24
       cronSchedule:
       description: got4 milk?
       emailTo:
       name: got4 milk?
       search: | inputlookup kpi.csv | dedup _time | sort _time | fit StateSpaceForecast input period=24 as preds | anomconfidences field_name=input pred_name=preds conf_name=anomConf | eval thresh = 0.878 | eval isOutlier = if(anomConf >= thresh, 1, 0) | anomintervals field_name=input conf_name=anomConf anom_name=isOutlier | table _time, input, isOutlier, anomConf
     }
     source: UI Telemetry
   }
   deploymentID: c551ac66-1d97-5dc7-98ac-634bcc99ebee
   eventID: c7c9a89f-40dd-cbfa-d47f-84909faf0cfd
   experienceID: e3567a53-e173-e2df-2d85-e4911b77d2b2
   optInRequired: 3
   splunkVersion: 9.0.3
   timestamp: 1678910922
   userID: 3dd53389b7530de43e28ba58dead9cda506df188cf348f24c5984be45bcbd3bc
   version: 4
   visibility: anonymous,support
}
app.session.delete_model_artifact_successful Deleting model artifacts associated with a job that was deleted was successful.
JSON 
{ 
   component: app.session.delete_model_artifact_successful
   data: { 
     app: Splunk_App_for_Anomaly_Detection
     cronSchedule:
     page: start
     rowData: { 
       alertExpiresTimeUnit: h
       alertExpiresValue: 24
     }
     source: UI Telemetry
   }
   deploymentID: 821a4186-5c1e-5c26-bc39-355b7a6d8559
   eventID: a8174b63-e49c-ffc8-a560-a87ce2bcdcf4
   experienceID: 079cf05d-ff0a-cf56-09ed-61499468e16b
   optInRequired: 3
   splunkVersion: 9.0.1
   timestamp: 1680287440
   userID: e0c7c133de97dccf5e30df7e77afb4c27de23536979fa897c36534b7c2b36fab
   version: 4
   visibility: anonymous,support
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp The data health check result. For example, if data contains missing values, or timestamps are unevenly spaced.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: {
     count: 3
     message: Health check score: 2; No data quality issues detected.
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: 7755BDFD-3BD5-4FA7-9D07-8EE044B378C3
   executionID: DEB3F0F8-3319-4B64-807E-581EE9BD2DF4
   optInRequired: 3
   timestamp: 1678880187
   type: aggregate
   visibility: [
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp The number of anomalies/ anomalous intervals detected in the data.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: {
     count: 5
     message: 1 anomalous interval(s) found.
   }
   deploymentID: db49a47c-7c97-544e-9236-f5e2f7547600
   eventID: C09FA2A1-A9F4-498F-9DD4-D6050FFACD00
   executionID: 46D024B4-E1EA-4394-BB47-966D92C731C0
   optInRequired: 3
   timestamp: 1678895466
   type: aggregate
   visibility: [
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp The length of the seasonal/periodic component (if one is found) in the data.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Detected seasonal period length: 1
   }
   deploymentID: a676d989-ba85-599f-91c2-9cb0c16722ed
   eventID: 9A7BBCAC-B0CE-48E5-A4FD-52FE37763AB2
   executionID: 15BA56B4-06DD-4420-A86A-D2BA2496EA1B
   optInRequired: 3
   timestamp: 1678876382
   type: aggregate
   visibility: [
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp Whether the user is running the app with Splunk preinstalled dataset or with their own data.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Using our included inputlookup data
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: DA0A3667-BF04-4427-8F77-339AB11079A2
   executionID: DEB3F0F8-3319-4B64-807E-581EE9BD2DF4
   optInRequired: 3
   timestamp: 1678880187
   type: aggregate
   visibility: [
     anonymous
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp The top and bottom 5 anomaly confidence scores found in the data.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Top 5 anomConfs: [0.9433 0.8127 0.7784 0.7269 0.7113]
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: F939CAC7-E468-4490-9915-BA448068533D
   executionID: DEB3F0F8-3319-4B64-807E-581EE9BD2DF4
   optInRequired: 3
   timestamp: 1678880187
   type: aggregate
   visibility: [ 
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp How long our custom algorithm took to run. Encompasses all backend computation other than the SPL query execution time.
JSON 
{ 
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Total execution time in seconds for `fit AutoAnomalyDetection` call: 0.5578451156616211
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: 813454ED-EDF5-488E-8BE2-00E3B64F5D01
   executionID: A2D51B94-F483-4367-AB4A-FA92B6DC5597
   optInRequired: 3
   timestamp: 1678972625
   type: aggregate
   visibility: [
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp The data resolution. The spacing between timestamps, in number of seconds.
JSON 
{
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Data resolution: 3600.0 seconds.
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: 813454ED-EDF5-488E-8BE2-00E3B64F5D01
   executionID: A2D51B94-F483-4367-AB4A-FA92B6DC5597
   optInRequired: 3
   timestamp: 1678972625
   type: aggregate
   visibility: [
   ]
}
app.Splunk_App_for_Anomaly_Detection.anomalyapp Range of the data values. Number of orders of magnitude between highest and lowest value.
JSON 
{
   app: Splunk_App_for_Anomaly_Detection
   component: app.Splunk_App_for_Anomaly_Detection.anomalyapp
   data: { 
     count: 1
     message: Data varies over 0.5844700114060526 orders of magnitude.
   }
   deploymentID: a2cbe2e4-ae0e-5dd1-9e15-af9aeff49113
   eventID: 813454ED-EDF5-488E-8BE2-00E3B64F5D01
   executionID: A2D51B94-F483-4367-AB4A-FA92B6DC5597
   optInRequired: 3
   timestamp: 1678972625
   type: aggregate
   visibility: [
   ]
}