How to pass values to head command at run time?

[Taruchit]

Hello All,

I need your help for using head command by passing the parameters at run time.

The background of the above is as follows: -

I am working on building a SPL to identify anomalous events in time series dataset.

I fetched average of the count of all events each hour and then compared with moving average to identify the datapoints and time instances when the average count of events during an hour were significantly greater than moving average at that point of time.

To understand the term "significantly greater", I computed the difference between average count of events for a day and the moving average up to the day and determine the percentage of difference with respect to moving average.

The observations varied across different datasets. That is for dataset 1, out of all events, 10% of the events had percentage of difference>=90%. However, for dataset 2, out of all events, 20% of the events had percentage of difference>=90%.

Thus, I decided to sort the results in descending order of percentage of difference and fetched first 10% of the total events by using head command.

Since the count of events returned varies for each dataset, how to compute and fetch 10% of events when the dataset is sorted in descending order based on percentage of difference?

Please share if I need to clarify or share any more details to articulate the above query better.

Thank you
Taruchit

[ITWhisperer · Accepted solution]

| streamstats count as row
| eventstats max(row) as total
| eval cuttoff=total/10
| where row <= cuttoff

[Taruchit]

Hi @ITWhisperer 

Thank you very much for your prompt help.

Thank you