How do I make my standard deviation search an alert, and will standard deviation be affected by how far back I search?

[dnsGuy314]

I don't want information about Prelert Anomaly Detection...I've already asked about purchasing that app, but I still have a need to get an alert in place today....

I've got a search that works well for my needs, but I'm not sure how to apply an alert to it.

Will standard deviation be affected by how far back I search? I want to schedule this to run every 15 minutes, but I want to ensure the standard deviation has a large enough sample size. Currently I'm searching back 7 days.

host=myServer source="mySource" earliest=-7d@d latest=now|eval Hour=strftime(_time, "%m-%d-%y %H:%M:%S")|stats sum(servfail) as "ServFail responses", stdevp(servfail) as standdev by Hour | eval two = 2* standdev

If I set an alert to run every 15 minutes with the above search, will I get an alert for an event until that alert is outside of the -7days timeframe?

[javiergn]

1 - If you data volume is not huge you should be able to apply this logic:

https://answers.splunk.com/answers/48205/comparing-todays-data-with-last-weeks-data.html

2 - Timewrap might be useful and easy to use too:

https://answers.splunk.com/answers/60295/comparing-time-ranges-one-report.html

3 - summary indexes (or a data model too) will give you a lot more control but it's obviously slightly more complicated to implemented:

• Aggregate your data (daily, hourly, ...) and store it in your summary index (or data model)
• Run your search and compare against your summary index (or data model) and alert if stddev is different to the expected values.

Hope that helps.

Thanks,
J