Dashboards & Visualizations

How to pass values to head command at run time?

Taruchit
Contributor

Hello All,

I need your help for using head command by passing the parameters at run time.

The background of the above is as follows: -

I am working on building a SPL to identify anomalous events in time series dataset.

I fetched average of the count of all events each hour and then compared with moving average to identify the datapoints and time instances when the average count of events during an hour were significantly greater than moving average at that point of time.

To understand the term "significantly greater", I computed the difference between average count of events for a day and the moving average up to the day and determine the percentage of difference with respect to moving average.

The observations varied across different datasets. That is for dataset 1, out of all events, 10% of the events had percentage of difference>=90%. However, for dataset 2, out of all events, 20% of the events had percentage of difference>=90%.

Thus, I decided to sort the results in descending order of percentage of difference and fetched first 10% of the total events by using head command.

Since the count of events returned varies for each dataset, how to compute and fetch 10% of events when the dataset is sorted in descending order based on percentage of difference?

Please share if I need to clarify or share any more details to articulate the above query better.

Thank you
Taruchit

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row
| eventstats max(row) as total
| eval cuttoff=total/10
| where row <= cuttoff

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row
| eventstats max(row) as total
| eval cuttoff=total/10
| where row <= cuttoff

Taruchit
Contributor

Hi @ITWhisperer 

Thank you very much for your prompt help.

Thank you

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...