https://community.splunk.com/t5/Splunk-Search/How-does-this-search-from-Splunk-documentation-work-to-calculate/m-p/119005#M31872 <P>I'd like to understand the mathematical meaning of the below search on documentation. Is this my understanding right that it calculates the outliers of 4.6% up or down based on the normal distribution?</P> <PRE><CODE>sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen &gt; AvgURILen+(2*StdDevURILen) </CODE></PRE> <P>Use the stats command and functions: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions">http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions</A></P> <P>If I want to get the 0.3% outliers, can I do this by just changing the condition like this? </P> <PRE><CODE>... | where URILen &gt; AvgURILen+(3*StdDevURILen) </CODE></PRE> Tue, 31 Mar 2015 04:25:49 GMT Shisa 2015-03-31T04:25:49Z https://community.splunk.com/t5/Splunk-Search/How-does-this-search-from-Splunk-documentation-work-to-calculate/m-p/119005#M31872 <P>I'd like to understand the mathematical meaning of the below search on documentation. Is this my understanding right that it calculates the outliers of 4.6% up or down based on the normal distribution?</P> <PRE><CODE>sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen &gt; AvgURILen+(2*StdDevURILen) </CODE></PRE> <P>Use the stats command and functions: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions">http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions</A></P> <P>If I want to get the 0.3% outliers, can I do this by just changing the condition like this? </P> <PRE><CODE>... | where URILen &gt; AvgURILen+(3*StdDevURILen) </CODE></PRE> Tue, 31 Mar 2015 04:25:49 GMT https://community.splunk.com/t5/Splunk-Search/How-does-this-search-from-Splunk-documentation-work-to-calculate/m-p/119005#M31872 Shisa 2015-03-31T04:25:49Z https://community.splunk.com/t5/Splunk-Search/How-does-this-search-from-Splunk-documentation-work-to-calculate/m-p/119006#M31873 <P>Hi Shisa,<BR /> This search returns events that macth URILen's average and URILen's sample standard deviation where URILen &gt; AvgURILen+(2*StdDevURILen) .</P> <P>If i understand your problems, you want to return events where <STRONG>URILen &gt; AvgURILen+(3*StdDevURILen)</STRONG> , this can be possible but, in your case, when i run <CODE>sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen &gt; AvgURILen+(3*StdDevURILen)| table AvgURILen StdDevURILen| table AvgURILen StdDevURILen</CODE> ,</P> <P>i get <STRONG>results not found</STRONG> . This explain that in the first part of query, that is <CODE>sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| table AvgURILen StdDevURILen URILen</CODE> </P> <P>which displays like follow, there is no values of <STRONG>URILen</STRONG> where we can have <STRONG>URILen &gt; AvgURILen+(3*StdDevURILen)</STRONG>. Thus, can't get results.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/295iEEF700602FE9D345/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 31 Mar 2015 15:32:51 GMT https://community.splunk.com/t5/Splunk-Search/How-does-this-search-from-Splunk-documentation-work-to-calculate/m-p/119006#M31873 ngatchasandra 2015-03-31T15:32:51Z