How to Grab Variance

a_n — Fri, 25 Jun 2021 09:30:18 GMT

Hello,

I am ingesting files containing host and ports for each host.

For each Source (FILE) The Nodes(host) and ports are being extracted and since I have many ports per node I have data as:
FILE #1, NodeX, Port: 443/tcp, 80/tcp,21/tcp (and more...)
-->using mvexpand for FILE#1 I have:
Node, Port
X, 443
X, 80
X,21
-->for FILE#2 I have the same
--> for file #3, I have:
X, 443
X, 80
(one port is missing, or in other scenarios added)
so the count for Node X per FILE will be
FILE, Count
File#1, 3
File#2, 3
File#3, 2

I want to grab when there is a change in that count and raise an alert.
I managed to show it on chart, but as I have many nodes, the chart is not suitable.
Can any one advise the best way to grab this variance and set the alert?
Thank you.

Re: How to Grab Variance

ITWhisperer — Fri, 25 Jun 2021 09:56:00 GMT

Try something like this

| dedup source node port | stats count by node port | eventstats max(count) as sources by node port | where count!= sources

Re: How to Grab Variance

a_n — Fri, 25 Jun 2021 10:18:21 GMT

Thank you,

With some minor modifications, it worked.
Appreciates.

topic Re: How to Grab Variance in Splunk Search

How to Grab Variance

Re: How to Grab Variance

Re: How to Grab Variance