https://community.splunk.com/t5/Splunk-Search/How-to-combine-start-hour-field-and-end-hour-field-and-then/m-p/223877#M65938 <P>First off you would need to convert starthour_and_endhour_yesterday and average(starthour_and_endhour)_for_last_7_days to numeric field (either in hour or minutes)</P> <P>For example 00-18 to be replaced with 18 (hrs), or something meaningful as per your use case. Then you can use <STRONG>stdev</STRONG> stats function on average numeric field multiplied by 3.</P> Tue, 29 Sep 2020 11:43:27 GMT niketn 2020-09-29T11:43:27Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-start-hour-field-and-end-hour-field-and-then/m-p/223876#M65937 <P>I have my splunk search as below</P> <P>My Search | where date_hour&gt;=16 OR date_hour&lt;9| convert ctime(_time) as Date_and_Time |eval StartHour=strftime(_time,"%H")|eval EndHour=strftime(_time,"%H") |stats earliest(StartHour) as StartHour latest(EndHour) as EndHour by student_id </P> <P>which displays the result as below</P> <P>student_id StartHour EndHour<BR /> X1234 00 19<BR /> Y6789 00 20<BR /> V5678 02 20<BR /> G4567 06 06</P> <P>Now I'm trying to acheive something like below</P> <P>student_id StartHour EndHour starthour_and_endhour_yesterday average(starthour_and_endhour)_for_last_7_days standard_deviation<BR /> X1234 00 19 00-18 00-03<BR /> Y6789 00 20 01-19 02-19<BR /> V5678 02 20 02-19 03-19<BR /> G4567 06 06 06-06 06-06</P> <P>Where standard_deviation is if student_id accessing starthour_and_endhour is 3 times standard deviation of average</P> <P>Now how can i calculate all the fields as mentioned above. Is it possible to acheive by splunk to find the suspecious behaviour of a student_id as mentioned on the above format?</P> Tue, 29 Sep 2020 11:47:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-start-hour-field-and-end-hour-field-and-then/m-p/223876#M65937 pavanae 2020-09-29T11:47:10Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-start-hour-field-and-end-hour-field-and-then/m-p/223877#M65938 <P>First off you would need to convert starthour_and_endhour_yesterday and average(starthour_and_endhour)_for_last_7_days to numeric field (either in hour or minutes)</P> <P>For example 00-18 to be replaced with 18 (hrs), or something meaningful as per your use case. Then you can use <STRONG>stdev</STRONG> stats function on average numeric field multiplied by 3.</P> Tue, 29 Sep 2020 11:43:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-start-hour-field-and-end-hour-field-and-then/m-p/223877#M65938 niketn 2020-09-29T11:43:27Z