Generating predictive models using clusters
In some implementations, sequences of time series values determined from machine data are obtained. Each sequence corresponds to a respective time series. A plurality of predictive models is generated for a first time series from the sequences of time series values. Each predictive model is to generate predicted values associated with the first time series using values of a second time series. For each of the plurality of predictive models, an error is determined between the corresponding predicted values and values associated with the first time series. A predictive model is selected for anomaly detection based on the determined error of the predictive model. Transmission is caused of an indication of an anomaly detected using the selected predictive model.
1 . A computer-implemented method comprising:
obtaining a set of time series for which to apply anomaly detection;
generating a set of clusters, wherein each cluster of the set of clusters includes at least one time series of the set of time series;
determining a representative time series for a first cluster of time series;
generating a predictive model for the representative time series, wherein the predictive model is configured to predict values associated with the representative time series; and
performing the anomaly detection, using the generated predictive model, on a time series associated with the first cluster of time series from which the predictive model is generated.
2 . The computer-implemented method of claim 1 , wherein the predictive model is configured to predict the values associated with the representative time series using first values associated with another time series of a second cluster.
3 . The computer-implemented method of claim 1 further comprising identifying the set of time series based on a user selection or interaction associated with the set of time series.
4 . The computer-implemented method of claim 1 , wherein the representative time series for the first cluster of time series corresponds to an aggregation of a plurality of the time series in the set of time series.
5 . The computer-implemented method of claim 1 , wherein the predictive model learns to predict the values using first values associated with another time series of a second cluster different from the first cluster of time series.
6 . The computer-implemented method of claim 1 further comprising performing the anomaly detection, using the generated predictive model, on each time series of the set of time series.
7 . The computer-implemented method of claim 1 , wherein the predictive model comprises one or more of a polynomial model, a neural network, or a decision tree model.
8 . The computer-implemented method of claim 1 , wherein data points of the set of time series are associated with respective time stamps of respective events.
9 . The computer-implemented method of claim 1 , further comprising training the predictive model over a training period using time series values corresponding to a different time series than the representative time series.
10 . One or more non-transitory computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform a computer- implemented method comprising:
obtaining a set of time series for which to apply anomaly detection;
generating a set of clusters, wherein each cluster of the set of clusters includes at least one time series of the set of time series;
determining a representative time series for a first cluster of time series;
generating a predictive model for the representative time series, wherein the predictive model is configured to predict values associated with the representative time series; and
performing the anomaly detection, using the generated predictive model, on a time series associated with the first cluster of time series from which the predictive model is generated.
11 . The one or more non-transitory computer-readable storage media of claim 10 , wherein the predictive model is configured to predict the values associated with the representative time series using first values associated with another time series of a second cluster.
12 . The one or more non-transitory computer-readable storage media of claim 10 further comprising identifying the set of time series based on a user selection or interaction associated with the set of time series.
13 . The one or more non-transitory computer-readable storage media of claim 10 , wherein the representative time series for the first cluster of time series corresponds to an aggregation of a plurality of the time series in the set of time series.
14 . The one or more non-transitory computer-readable storage media of claim 10 , wherein the predictive model learns to predict the values using first values associated with another time series of a second cluster different from the first cluster of time series.
15 . A computer-implemented system comprising:
one or more hardware processors;
one or more computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform a method comprising:
obtaining a set of time series for which to apply anomaly detection;
generating a set of clusters, wherein each cluster of the set of clusters includes at least one time series of the set of time series;
determining a representative time series for a first cluster of time series;
generating a predictive model for the representative time series, wherein the predictive model is configured to predict values associated with the representative time series; and
performing the anomaly detection, using the generated predictive model, on a time series associated with the first cluster of time series from which the predictive model is generated.
16 . The system of claim 15 , wherein the predictive model learns to predict the values using first values associated with another time series of a second cluster different from the first cluster of time series.
17 . The system of claim 15 , wherein the method further comprises performing the anomaly detection, using the generated predictive model, on each time series of the set of time series.
18 . The system of claim 15 , wherein the predictive model comprises one or more of a polynomial model, a neural network, or a decision tree model.
19 . The system of claim 15 , wherein data points of the set of time series are associated with respective time stamps of respective events.