topic Find the numerical outliers of the count for countries by day in Splunk Search

Find the numerical outliers of the count for countries by day

parwindertaank — Wed, 04 Apr 2018 17:35:03 GMT

I have the following which gives me the count of events that happen on separate days for each country.
Column1: Date, Column2: Country and Column3: Count

index="sample" sourcetype ="access_combined_wcookie" clientip=* | iplocation clientip | convert timeformat="%Y-%m-%d" ctime(_time) AS date | stats count by date, Country

For each Country, there are many days that occur that have events occurring on that day in total count.
I want to find the dates that have an abnormally high amount of events for each country and these would be the outliers.

How can I update my code to obtain this result?

Re: Find the numerical outliers of the count for countries by day

elliotproebstel — Wed, 04 Apr 2018 17:42:44 GMT

The final solution will depend on how you want to define an outlier. One option would be to identify dates where the count of events was greater than 2 standard deviations above the average count for that country:

index="sample" sourcetype ="access_combined_wcookie" clientip=* 
| iplocation clientip 
| convert timeformat="%Y-%m-%d" ctime(_time) AS date 
| stats count by date, Country 
| eventstats avg(count) as avg_count stdev(count) as stdev_count BY Country 
| where count>(avg_count+(2*stdev_count))

Re: Find the numerical outliers of the count for countries by day

parwindertaank — Wed, 04 Apr 2018 17:57:26 GMT

This is great thank you for your response.

Can this action also be performed using the Machine Learning Toolkit for Numerical Outliers?
Would the field to analyze be Count? And fields to split by Date and Country ?

Thanks in advance.

Re: Find the numerical outliers of the count for countries by day

elliotproebstel — Wed, 04 Apr 2018 18:01:00 GMT

Honestly, I've never used the Machine Learning Toolkit, so I can't tell you. If you want to get some answers to that, I'd recommend a new post with that specific question - otherwise, this conversation will likely get buried.

Re: Find the numerical outliers of the count for countries by day

chandana204 — Tue, 01 May 2018 19:03:49 GMT

Hi, I came across same kind of problem. I used this solution as reference. However, When I executed above search everything is working fine but stdev(count) is not working. It is only working when i remove BY country from the search. How can i find Standard deviation for every country?

Thanks,
Chandana