topic Alert when sample is 2 standard deviations from moving average in Alerting

Alert when sample is 2 standard deviations from moving average

jdamanpour — Thu, 09 Apr 2015 22:35:03 GMT

I am trying to develop an anomaly detector:

Search data...
Determine 95 percentile (or 2 std deviations from average) of last 30 min.
Determine the avg of the last 1 min.

Alert condition: avg(1min) > perc95(30min)

It would also be nice to be able to use a single graph of perc95(30min) and avg(1min) over the same multi-hour timeline.

I can get the data I want as separate series, but have not been able to integrate everything due to having 2 different sampling intervals. Any ideas?

Re: Alert when sample is 2 standard deviations from moving average

aljohnson_splun — Thu, 09 Apr 2015 23:43:06 GMT

sourcetype=access_combined earliest=-1w
| eval halfanhour = _time
| bucket halfanhour span=30m
| eval min = _time
| bucket min span=1m
| eventstats p95(bytes) as ninety_five by halfanhour
| eventstats mean(bytes) as minute_average by min
| timechart span=1m last(ninety_five) as "95th Percentile", last(minute_average) as "Average (minute)"

From this answer.

Make sure you set gaps to connected under format.