Hello All, 

I have been playing with Kapacitor, trying various ways to find anomaly like 
Morgoth, joining today's data with yesterday's and comparing the std deviation. 

I see Morgoth works great in the case when data pattern range is vast(which is 
in my case, it can vary from few hundreds to thousands).

Only problem i find with Morgoth is that it doesn't take into account the time 
of day in which the event occurred. Lets say at night time sum(count) is 
generally around 100 but in day time its 10,000. Above script will not give an 
alert if the sum(count) falls to 100 at the day time, as that is a common 
sum(count) for it. (during the night time).

Can suggest some better fingerprinting algorithm for Morgoth which takes time 
into account.

Or some other method for anomaly detection for data: 
1) Whose range is vast. (I can't just compare std. dev at all times)
2) There is a common pattern expected everyday. ( but we need to find this NOT 
at the day end) 

 Here is my existing TICKScript : 

var data = batch
        SELECT sum("count") 
        FROM "db"."autogen".events
        .groupBy('domain_name', 'domain_hash')
        .cron('*/15 * * * *')

    |deadman(0.0, 5m)
        .message('Deadman alert: less than 1 datapoint in 5m')

        // Trigger a critical alert when the window is marked as anomalous.
        .crit(lambda: "anomalous")

Thanks, any help is appreciated. 

Remember to include the version number!
You received this message because you are subscribed to the Google Groups 
"InfluxData" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to influxdb+unsubscr...@googlegroups.com.
To post to this group, send email to influxdb@googlegroups.com.
Visit this group at https://groups.google.com/group/influxdb.
To view this discussion on the web visit 
For more options, visit https://groups.google.com/d/optout.

Reply via email to