I am trying to develop an anomaly detector:
Search data...
Determine 95 percentile (or 2 std deviations from average) of last 30 min.
Determine the avg of the last 1 min.
Alert condition: avg(1min) > perc95(30min)
It would also be nice to be able to use a single graph of perc95(30min) and avg(1min) over the same multi-hour timeline.
I can get the data I want as separate series, but have not been able to integrate everything due to having 2 different sampling intervals. Any ideas?
sourcetype=access_combined earliest=-1w
| eval halfanhour = _time
| bucket halfanhour span=30m
| eval min = _time
| bucket min span=1m
| eventstats p95(bytes) as ninety_five by halfanhour
| eventstats mean(bytes) as minute_average by min
| timechart span=1m last(ninety_five) as "95th Percentile", last(minute_average) as "Average (minute)"
From this answer.
Make sure you set gaps to connected under format.