topic Re: How to exclude a row with respect to certain timestamp using outlier in Splunk Search

How to exclude a row with respect to certain timestamp using outlier

Srubhi — Fri, 13 Oct 2023 07:36:09 GMT

Hi,

i have the below table data where i have timecharted for 1hr time span i want to remove the row which is in red colour as it is coming with different time when compare to other data.

can i be using outlier command to perform this operation and how i can achieve this requirement.

Thank you in advance,

_time	B	C	D	E	F
2023-10-06 22:00
2023-10-07 22:00
2023-10-08 22:00
2023-10-09 09:00
2023-10-09 22:00
2023-10-10 09:00
2023-10-10 22:00
2023-10-11 22:00

Re: How to exclude a row with respect to certain timestamp using outlier

ITWhisperer — Fri, 13 Oct 2023 08:21:20 GMT

There is not really enough information here to be able to easily help you. Please can you share your full search and some anonymised sample events for the volunteers to work with.

Re: How to exclude a row with respect to certain timestamp using outlier

Srubhi — Tue, 17 Oct 2023 14:02:23 GMT

Hi @ITWhisperer

Sorry for the delay.
my expectation is, suppose everyday we have data at 22:00 we need to keep that data and ignore the rest other data.

can outlier be the option to ignore the data coming with different timestamp?
please note: it is not always 22:00 data it can we any time but we have to ignore the other timestamp data apart from the usual one.

base search:

| mstats sum(Entity.InMessageCount.count.Sum) as count span=1h where index=cloudwatch_metrics AND Namespace=Entity AND Environment=prod AND EntityName="Order.SupplierDepot" AND ServiceDenomination=OutboundBatcher by Namespace, Environment, ServiceDenomination, MetricName, EntityName | where count > 0

Output:

_time

Namespace

Environment

ServiceDenomination

MetricName

EntityName

Count

2023-10-06 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-07 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-08 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-09 09:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-09 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-10 09:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-10 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-11 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

2023-10-11 22:00

Entity

Test

TestBoundBatch

TestMessageCount

TestOrder.Supplier

Re: How to exclude a row with respect to certain timestamp using outlier

Srubhi — Wed, 18 Oct 2023 05:56:01 GMT

Hello @ITWhisperer ,

Is the above data is sufficient to resolve this issue. could you please help me in this.

Re: How to exclude a row with respect to certain timestamp using outlier

ITWhisperer — Wed, 18 Oct 2023 09:23:21 GMT

Not really. It doesn't tell me what data you are dealing with nor what search you are using.

Re: How to exclude a row with respect to certain timestamp using outlier

Srubhi — Wed, 18 Oct 2023 09:56:51 GMT

Hi @ITWhisperer

my expectation is, suppose everyday we have data at 22:00 we need to keep that data and ignore the rest other data.

can outlier be the option to ignore the data coming with different timestamp?
please note: it is not always 22:00 data it can we any time but we have to ignore the other timestamp data apart from the usual one.

base search:

| mstats sum(Entity.InMessageCount.count.Sum) as count span=1h where index=cloudwatch_metrics AND Namespace=Entity AND Environment=prod AND EntityName="Order.SupplierDepot" AND ServiceDenomination=OutboundBatcher by Namespace, Environment, ServiceDenomination, MetricName, EntityName
| where count > 0

Re: How to exclude a row with respect to certain timestamp using outlier

Srubhi — Wed, 18 Oct 2023 10:04:11 GMT

Output

_time	Namespace	Environment	ServiceDenomination	MetricName	EntityName	Count
2023-10-06 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	1
2023-10-07 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	2
2023-10-08 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	3
2023-10-09 09:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	4
2023-10-09 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	5
2023-10-10 09:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	6
2023-10-10 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	7
2023-10-11 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	8
2023-10-11 22:00	Entity	Test	TestBoundBatch	TestMessageCount	TestOrder.Supplier	9

Re: How to exclude a row with respect to certain timestamp using outlier

ITWhisperer — Wed, 18 Oct 2023 12:03:24 GMT

Try something like this

| where strftime(_time, "%H") != "22"