I'd like to understand the mathematical meaning of the below search on documentation. Is this my understanding right that it calculates the outliers of 4.6% up or down based on the normal distribution?
sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen > AvgURILen+(2*StdDevURILen)
Use the stats command and functions: http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Usethestatscommandandfunctions
If I want to get the 0.3% outliers, can I do this by just changing the condition like this?
... | where URILen > AvgURILen+(3*StdDevURILen)
Hi Shisa,
This search returns events that macth URILen's average and URILen's sample standard deviation where URILen > AvgURILen+(2*StdDevURILen) .
If i understand your problems, you want to return events where URILen > AvgURILen+(3*StdDevURILen) , this can be possible but, in your case, when i run sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| where URILen > AvgURILen+(3*StdDevURILen)| table AvgURILen StdDevURILen| table AvgURILen StdDevURILen
,
i get results not found . This explain that in the first part of query, that is sourcetype=access_* | eval URILen = len(useragent) | eventstats avg(URILen) as AvgURILen, stdev(URILen) as StdDevURILen| table AvgURILen StdDevURILen URILen
which displays like follow, there is no values of URILen where we can have URILen > AvgURILen+(3*StdDevURILen). Thus, can't get results.