I am attempting to create a ML job to detect rare source IPs. Using the Anomaly Detection wizard, I selected
Categorization, then picked
Rare and picked the
source.address for Categorization field. However, I get the following error:
Selected category field is invalid 1000 field values analyzed, 0% contain 3 or more tokens.
Can someone explain to me what type of ML job I should use to accomplish this?