Alert if value is greater than 2xSTDEV

[bcusick]

Hi,

I am trying to find outliers by using the idea of a Bell Curve. I have a search that provides stats on mean, standard deviation, and 2 standard deviations. The idea is to get an alert if the value of a field (totalMB) is greater than 2 standard deviations.

source=x action="1" | eval megabytes=bytes_out/1024/1024 | stats sum(megabytes) as totalMB by src_user | stats mean(totalMB) stdev(totalMB) as "deviation" | eval outlier=deviation*2 | where totalMB > outlier | table src_user totalMB

When I leave out | where totalMB < outlier | table src_user totalMB , the math checks out for mean and standard deviations. But I cannot get the fields to pop up (whether I do less than or greater than the falue outlier. There are matching results, but the search returns "0 results found".

Any help is appreciated.

Thanks,

B

[linu1988]

Second stats will take out your totalMB field.

source=x action="1" | eval megabytes=bytes_out/1024/1024 | stats sum(megabytes) as totalMB by src_user |append[|search source=x action="1" | eval megabytes=bytes_out/1024/1024 | stats sum(megabytes) as totalMB by src_user | stats mean(totalMB) stdev(totalMB) as "deviation" by src_user] | eval outlier=deviation*2 | stats Values(totalMB) as totalMB,Values(outlier) as outlier by src_user|where totalMB > outlier | table src_user totalMB

[bcusick]

when setting the deviation by user, this gives a stdev of 0 for each user, which isn't what we're trying to do. I changed this portion to "stats mean(totalMB) by user stdev(totalMB) as "deviation", but still no results. If there's an easy way to see the current value of deviation or outlier, that would help also

[linu1988]

Updated it

[bcusick]

When I run this search, I get an error. "Unknown search command 'source'."