Anomaly detection based on relationships between multiple time series

One or more non-transitory computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by one or more processors, cause the one or more processors to perform a computer-implemented method comprising:

• obtaining sequences of time series values determined from raw machine data, each sequence corresponding to a respective time series, wherein the raw machine data is produced by one or more components within an information technology or security environment and reflects activity within the information technology or security environment;
• generating a plurality of predictive models for a first time series from the sequences of time series values, each predictive model to generate predicted values associated with the first time series using time series values corresponding to a second time series;
• evaluating one or more characteristics of the plurality of predictive models;
• and
• automatically selecting a predictive model from the plurality of predictive models for anomaly detection based on the evaluating of the one or more characteristics.

A computer-implemented system comprising:

• one or more processors;
• one or more non-transitory computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by the one or more processors, cause the one or more processors to perform a method comprising:
• obtaining sequences of time series values determined from raw machine data, each sequence corresponding to a respective time series, wherein the raw machine data is produced by one or more components within an information technology or security environment and reflects activity within the information technology or security environment;
• generating a plurality of predictive models for a first time series from the sequences of time series values, each predictive model to generate predicted values associated with the first time series using time series values corresponding to a second time series;
• evaluating one or more characteristics of the plurality of predictive models;
• and automatically selecting a predictive model from the plurality of predictive models for anomaly detection based on the evaluating of the one or more characteristics.