Splunk Search
Highlighted

Outlier Identifier- help with query

Engager

I want to use the outlier function but am having trouble identifying the sources as outlier, this is what I have so far, but using stats and eval together is not working. Any help and would be greatly appreciated:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name| outlier type=iqr | eval Description=case(count>=stats max(count), "outlier", count<stats max(count), "not an outlier") 
0 Karma
Highlighted

Re: Outlier Identifier- help with query

Engager

Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 UserName!="-" | stats count by UserName | rename count AS originalcount | join type=inner UserName[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 UserName!="-" | stats count by UserName | rename count AS outliercount | outlier type=iqr] | eval Description=if(nullif(outliercount,originalcount)==outliercount,"outlier","not an outlier") | table UserName, originalcount, outlier_count, Description

View solution in original post

0 Karma