help for standard deviation with percentage query

[dhavamanis]

We have filed "status' and it will capture the http status code like 200, 301,302,404,503..etc. We want to setup alert if any increased 1% percentage of standard deviation in last 5 minutes for status ="5*" need to trigger an alert.

Can you please help us to write the Splunk query to calculate standard deviation with increased 1% in the last 5 minutes to display results.

Example: 503 status code in the last 5 minutes always less than 0.5 percentage. some cases the error condition it may increase the count 1% error rate from 0.5 %. in this situation need to trigger an alert.

[richcollier]

You could try the Prelert app (https://splunkbase.splunk.com/app/1306/) to detect anomalies instead - it uses machine learning to automatically detect anomalous deviations using a more sophisticated (and thus more accurate) modeling than just standard deviations. You can alert on these anomalies that are detected.