How to edit my search to filter transactions based on standard deviation of event count?

[troyward]

I have a search that is grouping events into transactions and includes the eventcount as part of it. The transaction is based on a source IP address and service. My goal is to determine the standard deviation of event count by source IP and then filter it to display only transactions that actually have and event count that falls outside of the standard deviation.

Search:

Search | transaction source_ip service maxpan=5m maxpause=60s eventcount | stats avg(eventcount) as average stdev(eventcount) as standarddev by source_ip | eval upperlimit=average+standarddev, oddball=if(eventcount > upperlimit,1,0) | search oddball=1

My problem is that I get it to figure out average, standarddev, and upperlimit for each source IP just fine, but it doesn't actually figure if each transaction group is "oddball" and then filter it out.

Thoughts?

Troy

[somesoni2 · Accepted solution]

The field eventcount is not available after you execute your stats command (only fields available will be average standarddev and source_ip). Give this a try

 Search | transaction source_ip service maxpan=5m maxpause=60s eventcount | eventstats avg(eventcount) as average stdev(eventcount) as standarddev by source_ip | eval upperlimit=average+standarddev, oddball=if(eventcount > upperlimit,1,0) | search oddball=1