[DOCS] Updates screenshots in ML population analysis (#58318)
This commit is contained in:
parent
7dda9934f9
commit
3169e4c70e
|
@ -62,26 +62,26 @@ the sample web logs in {kib}, you can use the following job settings in the
|
||||||
population job wizard:
|
population job wizard:
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/ml-population-job.jpg["Job settings in the population job wizard]
|
image::images/ml-population-job.png["Job settings in the population job wizard]
|
||||||
|
|
||||||
After you open the job and start the {dfeed} or supply data to the job, you can
|
After you open the job and start the {dfeed} or supply data to the job, you can
|
||||||
view the results in {kib}. For example, you can view the results in the
|
view the results in {kib}. For example, you can view the results in the
|
||||||
**Anomaly Explorer**:
|
**Anomaly Explorer**:
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/ml-population-results.jpg["Population analysis results in the Anomaly Explorer"]
|
image::images/ml-population-results.png["Population analysis results in the Anomaly Explorer"]
|
||||||
|
|
||||||
As in this case, the results are often quite sparse. There might be just a few
|
As in this case, the results are often quite sparse. There might be just a few
|
||||||
data points for the selected time period. Population analysis is particularly
|
data points for the selected time period. Population analysis is particularly
|
||||||
useful when you have many entities and the data for specific entitles is sporadic
|
useful when you have many entities and the data for specific entitles is sporadic
|
||||||
or sparse.
|
or sparse.
|
||||||
|
|
||||||
If you click on a section in the timeline or swimlanes, you can see more
|
If you click on a section in the timeline or swim lanes, you can see more
|
||||||
details about the anomalies:
|
details about the anomalies:
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/ml-population-anomaly.jpg["Anomaly details for a specific user"]
|
image::images/ml-population-anomaly.png["Anomaly details for a specific user"]
|
||||||
|
|
||||||
In this example, the client IP address `29.64.62.83` received a high volume of
|
In this example, the client IP address `30.156.16.164` received a low volume of
|
||||||
bytes on the date and time shown. This event is anomalous because the mean is
|
bytes on the date and time shown. This event is anomalous because the mean is
|
||||||
three times higher than the expected behavior of the population.
|
three times lower than the expected behavior of the population.
|
||||||
|
|
Binary file not shown.
Before Width: | Height: | Size: 162 KiB |
Binary file not shown.
After Width: | Height: | Size: 230 KiB |
Binary file not shown.
Before Width: | Height: | Size: 324 KiB |
Binary file not shown.
After Width: | Height: | Size: 371 KiB |
Binary file not shown.
Before Width: | Height: | Size: 277 KiB |
Binary file not shown.
After Width: | Height: | Size: 279 KiB |
Loading…
Reference in New Issue