Can you help me get a notification on an anomalous event?

[jwhughes58]

I have this search

| tstats count WHERE index=fw sourcetype=fw:threat host=hostname* by _time span=1h 
| makecontinuous span=1h _time 
| fillnull value=0 
| streamstats window=180 current=true avg("count") as avg stdev("count") as stdev 
| eval lowerBound=(avg-stdev*exact(3)), upperBound=(avg+stdev*exact(3)) 
| eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) 
| timechart sum(isOutlier) as outliers

What I would like to do is get a notification if there was an anomalous event yesterday.

I've tried various methods of searching for isOutlier=1 for yesterday only, but I must be doing something wrong since it always comes back empty, and I know I have an event yesterday.

Suggestions are welcome.

TIA,

Joe

[skoelpin · Accepted solution]

With the search above, you've confirmed an anomalous event is being returned right? If so, then you can simply add this at the end of your search

| where outliers>0

[jwhughes58]

Thanks, but not what I was looking for. I need something like were there any outliers yesterday.

[skoelpin]

Ah I missed the yesterday part. You can use relative_time to accomplish this

| eval ALERT = if(_time<relative_time(now(), "-0d@d"),"yesterday","today")
| where ALERT="yesterday" AND outliers>0

[jwhughes58]

Thanks, with a little change that worked. I had to use

| eval ALERT = if(_time > relative_time(now(), "-1d@d"), "yesterday", "today")
| where ALERT="yesterday" AND outliers>0

With that added to my original search a row is returned only if there was an outlier yesterday.

[skoelpin]

Can you accept the answer to the question? @jwhughes58