How to set lower and upper threshold deviation?

[majilan1]

Hi Splunkers,

This may be easy, but I'm not able to solve it if anyone can help.

I want to set a lower threshold to 15 standard deviation below the mean, and the upper threshold to 15 standard deviation above the mean, but I'm not sure how to implement that. 

Thanks!

[majilan1]

How would I implement that in what I do have, please? So this is what I have:

index=X  sourcetype=Y source=metrics.kv_log appln_name IN ("FEED_FILE_ROUTE", "FEED_INGEST_ROUTE") this_hour="*"

| bin span=1h _time

| stats latest(this-hour) AS Volume BY appln_name, _time

| eval day_of_week=strftime(_time,"%A"), hour=strftime(_time,"%H")

|lookup mt_expected_processed_volume.csv name as appln_name, day_of_week, hour

outputnew avg_volume, stdev_volume

[richgalloway · Accepted solution]

The general idea is to use the eventstats command to compute the standard deviation then use eval to calculate the lower and upper thresholds.  Like this:

| eventstats stdev(foo) as stdev, avg(foo) as avg
| eval lower=avg - stdev*15, upper=avg+stdev*15
| where (foo < lower OR foo > upper)