Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats

kalua — Fri, 10 Jul 2015 15:02:18 GMT

I am trying to write a query which returns the values in myCol which have a count greater than 3 times the standard deviation of the counts of values in myCol. I tried the following:

source="mySource" | stats count as myCount by myCol | append [ | search source="mySource" | stats count as myCount by myCol | stats stdev(myCount) as deviation ] | eval outlier=deviation*3 | stats values(myCount) as myCount, values(outlier) as outlier | where myCount > outlier | table myCol, myCount

However, no results are returned. How can I achieve this?

Re: Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats

woodcock — Fri, 10 Jul 2015 15:13:18 GMT

Try this as the core of your search:

source="mySource" | stats count as myCount by myCol | eventstats stdev(myCount) as deviation | eval outlier=deviation*3 | where myCount > outlier

topic Re: Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats in Splunk Search

Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats

Re: Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats