I have this search
| tstats count WHERE index=fw sourcetype=fw:threat host=hostname* by _time span=1h
| makecontinuous span=1h _time
| fillnull value=0
| streamstats window=180 current=true avg("count") as avg stdev("count") as stdev
| eval lowerBound=(avg-stdev*exact(3)), upperBound=(avg+stdev*exact(3))
| eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0)
| timechart sum(isOutlier) as outliers
What I would like to do is get a notification if there was an anomalous event yesterday.
I've tried various methods of searching for isOutlier=1 for yesterday only, but I must be doing something wrong since it always comes back empty, and I know I have an event yesterday.
Suggestions are welcome.
TIA,
Joe
With the search above, you've confirmed an anomalous event is being returned right? If so, then you can simply add this at the end of your search
| where outliers>0
With the search above, you've confirmed an anomalous event is being returned right? If so, then you can simply add this at the end of your search
| where outliers>0
Thanks, but not what I was looking for. I need something like were there any outliers yesterday.
Ah I missed the yesterday part. You can use relative_time
to accomplish this
| eval ALERT = if(_time<relative_time(now(), "-0d@d"),"yesterday","today")
| where ALERT="yesterday" AND outliers>0
Thanks, with a little change that worked. I had to use
| eval ALERT = if(_time > relative_time(now(), "-1d@d"), "yesterday", "today")
| where ALERT="yesterday" AND outliers>0
With that added to my original search a row is returned only if there was an outlier yesterday.
Can you accept the answer to the question? @jwhughes58