I want to run a daily alert to check for outliers in host crashes via the MLTK time series forecast algorithm; however, the syntax is not optimal for forecasting multiple hosts, so I have an initial filter which shows the list of hosts if the amount of crashes is higher than average. I want to take this output and then, for each host in the list, run the outlier detection as follows: | timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="14" period=7 lower"95"=lower"95" upper"95"=upper"95" | eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | fields - isOutlier But I'm not sure the best way to go about this. I know I can output the results from my initial filtering search to a lookup and then have separate queries that say "for the host from row 1, run outlier detection," and then "for host from row 2, run outlier detection," etc. but this would require separate alert queries for however many rows I would want to include. What I would really like is a query that iterates through the results of my initial filter, and then for each row, grab the host and run the outlier detection. Is there a way to run a loop like this? ... View more

I want to combine the data from a prediction algorithm on crashed applications with additional data about the crashed applications, namely the count of affected users. Right now, index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="0" period=7 lower"95"=lower"95" upper"95"=upper"95" | eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | fields - isOutlier|rename sum(VOLUME) as "Actual Crashes", prediction as "Predicted Crashes" gives me what I want for the prediction data, and index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d dc(USERNAME) as "Users" gives me the count of users, but index=index sourcetype="sourcetype" APPLICATION="app*"| timechart span=1d sum(VOLUME) | predict "sum(VOLUME)" as prediction algorithm="LLP5" future_timespan="30" holdback="0" period=7 lower"95"=lower"95" upper"95"=upper"95" | eval isOutlier = if(prediction!="" AND 'sum(VOLUME)' !="" AND ('sum(VOLUME)' < 'lower95(prediction)' OR 'sum(VOLUME)' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | fields - isOutlier|rename sum(VOLUME) as "Actual Crashes", prediction as "Predicted Crashes"|join[search index=index sourcetype="index" APPLICATION="app*"| timechart span=1d dc(USERNAME) as "Users"] doesn't give me the correct count of users in the table. Any ideas on how to combine these searches properly? ... View more

In my dashboard, I have the user select a server and then a line chart displays of application crashes on the selected server. I also want a drilldown set up so that if the user clicks a server from another table on the dashboard, the line chart adds data from the drilldown server. However when I try to set this up, the line chart will only populate if both the multiselect input and the drilldown are selected. How do I fix this so that data will load if no drilldown is selected? <label>Host</label> <choice value="*">All</choice> <default>*</default> <delimiter>","</delimiter> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>index=*|stats count by host</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="time" token="time"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <chart> <search> <query>index=* host IN ($host$) OR host="$hostclick$"|timechart count(EventCode) by host</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <table> <title>Top 20 Hosts</title> <search> <query>index=*|top host limit=20</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="hostclick">$click.value$</set> </drilldown> </table> </panel> ... View more