Splunk Search

Bell Curve Average Duration times

dreamwork801
Path Finder

So I am trying to get an average duration time for request.
Currently I am using this request with gets the top 5 percent, and bottom 5 percent of times and removes them with the idea that they are outliers. I realized that this may not always be accurate if the top 5 or bottom 5 percent are actually close to the mean and not outliers. So how would I change this search to remove anything that is 3 standard deviations away from the mean?

"Data.PlatformTeam" = "payments" | eventstats perc95(Duration) as Perc95, perc5(Duration) as Perc5 by Name| where Duration < Perc95 | where Duration > Perc5 | stats avg(Duration) as Average, count as Frequency by Name | sort -Average

1 Solution

emiller42
Motivator

This will do it.

"Data.PlatformTeam"="payments"  | eventstats avg(duration) as avg stdev(duration) as stdev by Name |  where abs(duration-avg) < stdev*3 | stats avg(duration) as Average, count as Frequency by Name | sort -Average

View solution in original post

emiller42
Motivator

This will do it.

"Data.PlatformTeam"="payments"  | eventstats avg(duration) as avg stdev(duration) as stdev by Name |  where abs(duration-avg) < stdev*3 | stats avg(duration) as Average, count as Frequency by Name | sort -Average

dreamwork801
Path Finder

This is exactly what I was looking for. Thank you

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this?

"Data.PlatformTeam" = "payments" | eventstats mean(Duration) as mean, stdev(Duration) as stdev by Name| where abs(mean-stdev)< 3 | stats avg(Duration) as Average, count as Frequency by Name | sort -Average
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...