Visualizing outliers from timestamped event data using machine learning-based models
Techniques are described for providing a machine learning (ML) data analytics application including guided ML workflows that facilitate the end-to-end training and use of various types of ML models, where such guided workflows may also be referred to as ML “experiments.” One such model is an outlier detection model to assist in the monitoring of computer network traffic and computer performance. For example, the ML data analytics application may generate an outlier detection model using user-identified data from a data source and parameter information. The generates outlier detection model can include distribution functions of distribution types selected from a plurality of distribution types by a distribution fitting algorithm.
1. A computer-implemented method comprising:
causing display of a guided workflow, wherein the guided workflow includes: a first user interface component enabling user identification of timestamped event data to be used to generate an outlier detection model, and a second user interface component enabling user indication of parameter information related to the outlier detection model;
generating the outlier detection model based on the timestamped event data and the parameter information related to the outlier detection model obtained via the guided workflow; and
causing display of a visualization of outlier detection results generated using the outlier detection model.
2. The computer-implemented method of claim 1 , wherein the outlier detection model includes a distribution function of a distribution type selected from a plurality of distribution types by a distribution fitting algorithm, wherein the plurality of distribution types include a Gaussian distribution, a Gaussian kernel density estimation (KDE) distribution, and an exponential distribution.
3. The computer-implemented method of claim 2 , further comprising:
identifying, using the distribution fitting algorithm, the distribution function from a plurality of distribution functions, the distribution function having a highest likelihood of matching the timestamped event data; and
selecting the distribution function for display on the second user interface component.
4. The computer-implemented method of claim 1 , further comprising:
receiving input, via the second user interface component, identifying a field contained in the timestamped event data, wherein the outlier detection model is generated based on values associated with the field, and wherein the second user interface component includes a visualization showing one or more distribution functions modeled based on the values associated with the field.
5. The computer-implemented method of claim 4 , wherein the visualization of outlier detection results includes icons indicating locations of outlier data points for each of the one or more distribution functions.
6. The computer-implemented method of claim 1 , further comprising causing display of a third user interface component, the third user interface component including user interface elements enabling one or more of: deploying the outlier detection model to a data intake and query system, creating an alert associated with the outlier detection results generated using the outlier detection model, and scheduling additional training of the outlier detection model.
7. The computer-implemented method of claim 1 , wherein the parameter information related to the outlier detection model includes a field to analyze, a set of selectable options to define data subsets of the timestamped event data associated with the field to analyze, a distribution type, and an outlier tolerance threshold, wherein the outlier tolerance threshold is an upper bound on a percentage of data points from the timestamped event data being numerical outliers.
8. The computer-implemented method of claim 7 , further comprising:
receiving input, via the second user interface component, modifying the outlier tolerance threshold to produce a modified outlier tolerance threshold; and
in response to receiving the input, modifying the visualization of the outlier detection results generated using the outlier detection model based on the modified outlier tolerance threshold.
9. The computer-implemented method of claim 7 , wherein the parameter information further includes a time feature, and wherein the method further comprises:
receiving, via the second user interface component, a selection to enable the time feature; and
in response to receiving the selection to enable the time feature, modifying the set of selectable options to define data subsets of the timestamped event data associated with the field to analyze to include time options.
10. The computer-implemented method of claim 9 , wherein the outlier detection model further includes a time series representation of the timestamped event data based on the parameter information related to the outlier detection model, the parameter information including a selected time option from the time options.
11. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
causing display of a guided workflow, wherein the guided workflow includes: a first user interface component enabling user identification of timestamped event data to be used to generate an outlier detection model, and a second user interface component enabling user indication of parameter information related to the outlier detection model;
generating the outlier detection model based on the timestamped event data and the parameter information related to the outlier detection model obtained via the guided workflow; and
causing display of a visualization of outlier detection results generated using the outlier detection model.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the outlier detection model includes a distribution function of a distribution type selected from a plurality of distribution types by a distribution fitting algorithm, wherein the plurality of distribution types include a Gaussian distribution, a Gaussian kernel density estimation (KDE) distribution, and an exponential distribution.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the instructions further cause performance of operations comprising:
identifying, using the distribution fitting algorithm, the distribution function from a plurality of distribution functions, the distribution function having a highest likelihood of matching the timestamped event data; and
selecting the distribution function for display on the second user interface component.
14. The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further cause performance of operations comprising:
receiving input, via the second user interface component, identifying a field contained in the timestamped event data, wherein the outlier detection model is generated based on values associated with the field, and wherein the second user interface component includes a visualization showing one or more distribution functions modeled based on the values associated with the field.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the visualization of outlier detection results includes icons indicating locations of outlier data points for each of the one or more distribution functions.
16. An apparatus, comprising:
one or more processors;
a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
cause display of a guided workflow, wherein the guided workflow includes: a first user interface component enabling user identification of timestamped event data to be used to generate an outlier detection model, and a second user interface component enabling user indication of parameter information related to the outlier detection model;
generate the outlier detection model based on the timestamped event data and the parameter information related to the outlier detection model obtained via the guided workflow; and
cause display of a visualization of outlier detection results generated using the outlier detection model.
17. The apparatus of claim 16 , wherein the outlier detection model includes a distribution function of a distribution type selected from a plurality of distribution types by a distribution fitting algorithm, wherein the plurality of distribution types include a Gaussian distribution, a Gaussian kernel density estimation (KDE) distribution, and an exponential distribution.
18. The apparatus of claim 17 , wherein the instructions, when executed, further cause the apparatus to:
identify, using the distribution fitting algorithm, the distribution function from a plurality of distribution functions, the distribution function having a highest likelihood of matching the timestamped event data; and
select the distribution function for display on the second user interface component.
19. The apparatus of claim 16 , wherein the instructions, when executed, further cause the apparatus to:
receive input, via the second user interface component, identifying a field contained in the timestamped event data, wherein the outlier detection model is generated based on values associated with the field, and wherein the second user interface component includes a visualization showing one or more distribution functions modeled based on the values associated with the field.
20. The apparatus of claim 19 , wherein the visualization of outlier detection results includes icons indicating locations of outlier data points for each of the one or more distribution functions.