Splunk Search

Why do I keep getting outliers in network?

Hassan989
New Member

Hi Team, 

I'm trying to find outliers in the network kpi for a project but every time I run this query I get 0 outliers so I'm stuck on what's wrong with my query. 

this is it:

| mstats avg("Network_Interface.Bytes_Received/sec") As Packets_Received stdev("Network_Interface.Bytes_Received/sec") as stdev WHERE index=dcn_nc01_os AND host = HIC026117
| eval lowerBound=(Packets_Received-stdev*exact(2)), upperBound=(Packets_Received+stdev*exact(2))
| eval isOutlier=if('Network_Interface.Bytes_Received/sec' < lowerBound OR 'Network_Interface.Bytes_Received/sec' > upperBound, 1, 0)

any ideas or fixes are much appreciated! 

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Hassan989 ... troubleshooting this requires more details from your side. 

1) when you run the first portion of that search query, do you get any results?

| mstats avg("Network_Interface.Bytes_Received/sec") As Packets_Received stdev("Network_Interface.Bytes_Received/sec") as stdev WHERE index=dcn_nc01_os AND host = HIC026117

2) if yes, then we should troubleshoot the remaining SPL query. 

3) if you dont get any results, then, pls suggest us.. if the apps, add-ons are installed or not.. how many UFs are sending network events.. many other questions will raise depending on above answers.. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...