topic Re: anomaly detection in Splunk Search

How to select only specific values into search?

badrinath — Mon, 09 May 2022 17:18:46 GMT

Hi all, I have a table and I need to highlight the values that are greater than lets say 5 in a line graph. how to select only those specific values into search

Re: anomaly detection

ITWhisperer — Mon, 09 May 2022 13:28:15 GMT

your search | where value > 5

Re: anomaly detection

richgalloway — Mon, 09 May 2022 13:40:13 GMT

This use case is not clear. You have a table and want to make a line graph? Do you want to highlight the anomalous values or select them?

If you know you only want values greater than 5 then a where clause should do the job.

,,, | where myField > 5

If you don't know what the threshold value should be then consider the anomalousvalue command.

... | anomalousvalue action=filter myField

Do tell us more about the use so we can offer better answers.

Re: anomaly detection

badrinath — Tue, 10 May 2022 04:08:41 GMT

thanks for the reply, but actually I have this kind of values

and I am using this query

..... | bucket _time span=10m

| chart count by _time,country

and I got the result as shown below

now when I convert it into a graph I wanted to highlight pints that are greater than 5 and also to filterout those points.

Re: anomaly detection

ITWhisperer — Tue, 10 May 2022 05:41:25 GMT

| bin _time span=10m | stats count by _time country | where count > 5 | xyseries _time country count

Re: anomaly detection

badrinath — Tue, 10 May 2022 05:51:06 GMT

thankyou, that worked but first I need to show the graph for all the data then highlight the points greater then 5 and then filter out those points.

this worked well for filtering but I need to highlight them also

Re: anomaly detection

ITWhisperer — Tue, 10 May 2022 06:01:55 GMT

A graph is a visualisation of a table of data.

You can have a table with all the data and you can have another table with the filtered data - the visualisation isn't normally going to change from one table to the other.

Re: anomaly detection

badrinath — Tue, 10 May 2022 06:06:00 GMT

In the graph with all the data I need to highlight only the points that are greater than 5 is it possible?

Re: anomaly detection

ITWhisperer — Tue, 10 May 2022 06:12:57 GMT

This is not possible with standard graphs (as far as I am aware) - having said that, you could overlay a line at 5 so that it is obvious which point are above it

Re: anomaly detection

badrinath — Tue, 10 May 2022 06:14:12 GMT

But I am using dashboard studio and I think overlay is not possible in it can you please conform

Re: anomaly detection

ITWhisperer — Tue, 10 May 2022 06:18:11 GMT

I don't use Dashboard Studio due to such limitations!

If you are already using a line graph, it could just be another series in the table

Re: anomaly detection

badrinath — Tue, 10 May 2022 06:24:42 GMT

thanks