Alerting

Alert when sample is 2 standard deviations from moving average

jdamanpour
New Member

I am trying to develop an anomaly detector:

Search data...
Determine 95 percentile (or 2 std deviations from average) of last 30 min.
Determine the avg of the last 1 min.

Alert condition: avg(1min) > perc95(30min)

It would also be nice to be able to use a single graph of perc95(30min) and avg(1min) over the same multi-hour timeline.

I can get the data I want as separate series, but have not been able to integrate everything due to having 2 different sampling intervals. Any ideas?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee
sourcetype=access_combined earliest=-1w
| eval halfanhour = _time
| bucket halfanhour span=30m
| eval min = _time
| bucket min span=1m
| eventstats p95(bytes) as ninety_five by halfanhour
| eventstats mean(bytes) as minute_average by min
| timechart span=1m last(ninety_five) as "95th Percentile", last(minute_average) as "Average (minute)"

From this answer.

Make sure you set gaps to connected under format.


alt text

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...