Need search help

[tkwaller]

Hello

I have a search that timecharts useragent count by useragent. Simply
index=apache useragent=* | timechart count by useragent limit=100

what I would like to do is overlay a lower boundary so if the count in part of this span is lower than the boundary send an alert.
I tried this several different ways.

This was my last attempt:
index=apache* useragent=* | stats count as TotalCount, avg(TotalCount) AS AvgCount, perc5(TotalCount) by _time, useragent

Unfortunately I only get a TotalCount and nothing more.
Any ideas?
Thanks!

[somesoni2 · Accepted solution]

Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.

index=apache* useragent=* 
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count

[tkwaller]

Haha was just gettign there myself:
index=apache* useragent=* | timechart count by useragent | eventstats perc5(count) as Lower by useragent

was close at least.
Small changes