Splunk Inc.
Processing data streams received from instrumented software in real time using incremental-decremental implementation of the KPSS stationarity statistic

Abstract:

An analysis system receives a time series. The data values of the time series correspond to a metric describing a characteristic of the computing system that changes over time. The analysis system stores a statistic value that represents the stationarity of the time series. In response to receiving a most recent value, the analysis system assigns the most recent value as the leading value in a window before retrieving the trailing value of the window. The analysis system updates the statistic value to add an influence of the most recent value and remove an influence of the trailing value. If the statistic value is less than a threshold, the analysis system determines that the time series is stationary. In response to determining the time series is stationary, the analysis system assigns an alert to the metric. The analysis system detects an anomaly in the metric based on the assigned alert.