Splunk Search

Outlier Identifier- help with query

marywill
Engager

I want to use the outlier function but am having trouble identifying the sources as outlier, this is what I have so far, but using stats and eval together is not working. Any help and would be greatly appreciated:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name| outlier type=iqr | eval Description=case(count>=stats max(count), "outlier", count<stats max(count), "not an outlier") 
0 Karma
1 Solution

marywill
Engager

Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description

View solution in original post

0 Karma

marywill
Engager

Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...