Splunk Search

How to use dynamically calculated threshold in alert search?

nkkn87
New Member

Hi all,

I need to calculate the standard deviation value using previous 5mins of data and have to recalculate every 5 mins.. After getting the result, I need to use that calculated standard deviation value as a threshold value for upcoming data for 5mins. if the upcoming data is more than threshold, I need to trigger alert. How can I do about it?

Here is my search:
1. Calculate standard devi
source="tcp:9996" index="data" sourcetype="xml" earliest=-10m latest=-5m|stats avg(Ch3) as alpha stdev(Ch3) as sd|eval temp=sd|eval sigma=temp*3
2. check the value
source="tcp:9996" index="data" sourcetype="xml" streamstats current=false values(Ch3) as curVal |table _time curVal|where curVal>sigma

I do not know how to combine this 2 search as I cannot access sigma from search 2.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

source="tcp:9996" index="data" sourcetype="xml" streamstats current=false values(Ch3) as curVal |table _time curVal|where curVal> [search source="tcp:9996" index="data" sourcetype="xml" earliest=-10m latest=-5m|stats stdev(Ch3) as sd |eval search=temp*3 | table search]

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

source="tcp:9996" index="data" sourcetype="xml" streamstats current=false values(Ch3) as curVal |table _time curVal|where curVal> [search source="tcp:9996" index="data" sourcetype="xml" earliest=-10m latest=-5m|stats stdev(Ch3) as sd |eval search=temp*3 | table search]
0 Karma

nkkn87
New Member

Hi,

Now I am able to get the results when I use |return $search]. However, the search in this bracket [search ...] does not refresh or update the standard devi result every 5 mins although I set the search criteria in Realtime unless I use the dashboard set 'auto refresh delay'. So is there any way that I can make it auto update by not using the dashboard?

0 Karma

nkkn87
New Member

Thanks for the reply. I am having an error "Error in 'where' command: Typechecking failed. The '>' operator received different types."

0 Karma

nkkn87
New Member

Now when I try return search instead of table search, I get the following error:
"Error in 'where' command: The operator at '="0.069815009607701730"' is invalid." . looks like calculated value is returned.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...