topic Re: How to display an event count deviation? in Dashboards & Visualizations

How to display an event count deviation?

matthew_foos — Thu, 29 Mar 2018 18:40:31 GMT

Hello all,

I've been tasked with building a standard deviation alert / dashboard / report by using the total count of events over 7 days. I've tried the following search with no success:

| metadata type=hosts index=* which gives me a totalCount of events for my hosts.

I'm trying to figure out how to display any deviation that is +/- 10% and alert on this.

I'm happy to provide further information.

Thanks!

Re: How to display an event count deviation?

kmaron — Thu, 29 Mar 2018 18:58:27 GMT

a deviation over what time frame? You said 7 days for the total count but are you comparing daily? hourly?

Re: How to display an event count deviation?

matthew_foos — Mon, 02 Apr 2018 15:37:43 GMT

I will be comparing daily.

Re: How to display an event count deviation?

kmaron — Tue, 03 Apr 2018 12:32:20 GMT

okay try this

base search 
| bucket _time span=1d
| stats count BY _time countedfield
| eventstats stdev(count) as stdev BY countedfield
| eval stdevincrease = (stdev*1.1)
| where count > stdevincrease AND _time > now()-(24*60*60)

Set your earliest to be 7 days and your latest to be now.
Your buckets are 1 day time spans
the eventstats will do the standard deviation over the 7 days then the where clause only looks at the last day
So you can set your alert to trigger on anything greater than 0