Splunk Dev

Can you help me get a notification on an anomalous event?

jwhughes58
Contributor

I have this search

| tstats count WHERE index=fw sourcetype=fw:threat host=hostname* by _time span=1h 
| makecontinuous span=1h _time 
| fillnull value=0 
| streamstats window=180 current=true avg("count") as avg stdev("count") as stdev 
| eval lowerBound=(avg-stdev*exact(3)), upperBound=(avg+stdev*exact(3)) 
| eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) 
| timechart sum(isOutlier) as outliers

What I would like to do is get a notification if there was an anomalous event yesterday.

I've tried various methods of searching for isOutlier=1 for yesterday only, but I must be doing something wrong since it always comes back empty, and I know I have an event yesterday.

Suggestions are welcome.

TIA,

Joe

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

With the search above, you've confirmed an anomalous event is being returned right? If so, then you can simply add this at the end of your search

| where outliers>0

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

With the search above, you've confirmed an anomalous event is being returned right? If so, then you can simply add this at the end of your search

| where outliers>0
0 Karma

jwhughes58
Contributor

Thanks, but not what I was looking for. I need something like were there any outliers yesterday.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Ah I missed the yesterday part. You can use relative_time to accomplish this

| eval ALERT = if(_time<relative_time(now(), "-0d@d"),"yesterday","today")
| where ALERT="yesterday" AND outliers>0
0 Karma

jwhughes58
Contributor

Thanks, with a little change that worked. I had to use

| eval ALERT = if(_time > relative_time(now(), "-1d@d"), "yesterday", "today")
| where ALERT="yesterday" AND outliers>0

With that added to my original search a row is returned only if there was an outlier yesterday.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you accept the answer to the question? @jwhughes58

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...