(The following does not apply to any of Subaru's many newer DIT [Direct Injected] platforms)
The key when analyzing data logs is to keep in mind that the knock detection systems on these cars is not overly sophisticated and can report knock events when no knock has occurred. This is fairly typical at lower load or with bigger throttle changes. Also, some occasional small corrections can be normal and do not necessarily indicate a problem. Some general things that I look for that may indicate that a car has a knock issue to be addressed (based on logging):
1. Feedback knock correction or Fine knock learning -4.2 or worse at low loads (i.e. cruise/low throttle situations).
2. Fine Knock Learning of -2.8 or worse during wide open throttle (WOT) run.
3. Fine Knock Learning of -1.4 if it consistently covers a large portion of the WOT run (indicating multiple cells involved)
4. Feedback Knock (-1.4) in the middle of your WOT run that is fairly consistent run to run, but does not start near when you mash the throttle. The first time it drops (ex. goes from 0 to -1.4) is when the knock event happened for feedback knock - the rest is it just ramping back to zero (unless it drops again).
5. Feedback Knock of -2.8 or worse at WOT if not due to mashing the throttle.
6. If your dynamic advance multiplier (DAM) drops from 1.0 (for 2.5L Subarus) or 16 (for 2.0L Subarus). Keep in mind that some maps start the DAM at a lower value when you reflash or reset the ECU and this is normal and not a cause for concern - will eventually learn up to its max if all is good.