Splunk Search

How does this search from Splunk documentation work to calculate the percentage of outliers?

Shisa
Explorer

I'd like to understand the mathematical meaning of the below search on documentation. Is this my understanding right that it calculates the outliers of 4.6% up or down based on the normal distribution?

sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen > AvgURILen+(2*StdDevURILen) 

Use the stats command and functions: http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions

If I want to get the 0.3% outliers, can I do this by just changing the condition like this?

... | where URILen > AvgURILen+(3*StdDevURILen)
Tags (3)
0 Karma

ngatchasandra
Builder

Hi Shisa,
This search returns events that macth URILen's average and URILen's sample standard deviation where URILen > AvgURILen+(2*StdDevURILen) .

If i understand your problems, you want to return events where URILen > AvgURILen+(3*StdDevURILen) , this can be possible but, in your case, when i run sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen > AvgURILen+(3*StdDevURILen)| table AvgURILen StdDevURILen| table AvgURILen StdDevURILen ,

i get results not found . This explain that in the first part of query, that is sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| table AvgURILen StdDevURILen URILen

which displays like follow, there is no values of URILen where we can have URILen > AvgURILen+(3*StdDevURILen). Thus, can't get results.

alt text

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...