topic Re: Need search help in Splunk Search

Need search help

tkwaller — Wed, 08 Mar 2017 20:13:37 GMT

Hello

I have a search that timecharts useragent count by useragent. Simply
index=apache useragent=* | timechart count by useragent limit=100

what I would like to do is overlay a lower boundary so if the count in part of this span is lower than the boundary send an alert.
I tried this several different ways.

This was my last attempt:
index=apache* useragent=* | stats count as TotalCount, avg(TotalCount) AS AvgCount, perc5(TotalCount) by _time, useragent

Unfortunately I only get a TotalCount and nothing more.
Any ideas?
Thanks!

Re: Need search help

somesoni2 — Wed, 08 Mar 2017 20:44:24 GMT

Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.

index=apache* useragent=* 
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count

Re: Need search help

tkwaller — Wed, 08 Mar 2017 20:48:04 GMT

Haha was just gettign there myself:
index=apache* useragent=* | timechart count by useragent | eventstats perc5(count) as Lower by useragent

was close at least.
Small changes