topic Re: lower and upper threshold deviation in Splunk Search

How to set lower and upper threshold deviation?

majilan1 — Thu, 07 Jul 2022 14:28:42 GMT

Hi Splunkers,

This may be easy, but I'm not able to solve it if anyone can help.

I want to set a lower threshold to 15 standard deviation below the mean, and the upper threshold to 15 standard deviation above the mean, but I'm not sure how to implement that.

Thanks!

Re: lower and upper threshold deviation

richgalloway — Wed, 06 Jul 2022 15:37:18 GMT

The general idea is to use the eventstats command to compute the standard deviation then use eval to calculate the lower and upper thresholds. Like this:

| eventstats stdev(foo) as stdev, avg(foo) as avg | eval lower=avg - stdev*15, upper=avg+stdev*15 | where (foo < lower OR foo > upper)

Re: lower and upper threshold deviation

majilan1 — Wed, 06 Jul 2022 17:38:27 GMT

How would I implement that in what I do have, please? So this is what I have:

index=X sourcetype=Y source=metrics.kv_log appln_name IN ("FEED_FILE_ROUTE", "FEED_INGEST_ROUTE") this_hour="*"

| bin span=1h _time

| stats latest(this-hour) AS Volume BY appln_name, _time

| eval day_of_week=strftime(_time,"%A"), hour=strftime(_time,"%H")

|lookup mt_expected_processed_volume.csv name as appln_name, day_of_week, hour

outputnew avg_volume, stdev_volume