I don't have any problem getting the Q1, Median, Q3, and IQR values using percX(), median and eval. What I'm having trouble with is separating the outliers from the rest of the data. I'm trying to do something like this: index=foo |stats p25(bar) as q1, p50(bar) as bmed, p75(bar) as q3 |eval irq=q3-q1 |eval lfence=q1-1.5*iqr |eval ufence=q3+1.5*iqr |search bar>=lfence bar<=ufence |stats min(bar) as lfence, max(bar) as ufence |table lfence,q1,bmed,q3,ufence,iqr However this returns no results. Does anyone know how I can get these values? I know outlier uses IQR to remove outliers, but if I used that first it would change the median, q1, q3 and iqr. ... View more

How can I use outlier with grouping. For instance, if I want to group my data by country, I would like to remove outliers from each group's data, not from the population as a whole. This is a problem for me because some countries generate far more events than others, which skews the data. So, while a data point might seem like an outlier for the total population, it might be relatively normal for that particular country. Is there a way to do this? Here's an example to help clarify: user | country | foo | bar --------------------------- 1 | us | 1 | 10 2 | us | 2 | 12 3 | us | 21 | 12 4 | ca | 20 | 13 5 | ca | 21 | 11 Ultimate output desired: country | avg(foo) | avg(bar) ----------------------------- us | 1.5 | 11 ca | 20.5 | 12 From the above, in the US users 3's foo value is an outlier, but that's a normal value for CA users. What I would like to be able to do is detect that user 3 is an outlier and discard that data, but keep the values for users 4 and 5 intact. Also, in my data there would be a lot more US events which would cause almost all the CA values to look like outliers. ... View more

When using the outlier function will it remove the whole log entry from the set of values to process, or does it just remove individual values from their respective fields. For instance: [rest of search]|outlier action=rm cnt foo bar cnt 1 10 5 2 15 6 1 10 100 avg(foo) avg(bar) avg(cnt) All log #3 removed: 1.5 12.5 5.5 Just cnt outlier removed: 1.33 11.66 5.5 ... View more

When sharing a search result I would like to disable clicking on the individual table cells. I would still like to be able to sort by column by clicking on the column header though. This comes up a lot when i share results that took a long time to run and someone accidentally clicks on a cell which causes splunk tries to run a huge query all over again. I saw this post: http://splunk-base.splunk.com/answers/7646/how-to-disable-results-table-row-clicking But I would specifically like to disable drilldown when sharing saved results, not when creating a view or dashboard. ... View more

I would like to group a bunch of data by date, but splunk doesn't seem to have a function to do this explicitly. So, I used this workaround: index=foo |eval date=strftime(_time, "%Y-%m-%d") |stats avg(bar) AS BarAvg, avg(stuff) AS StuffAvg BY date,country |table country, date, BarAvg, StuffAvg Now, as far as grouping all the data appropriately this works fine. The problem is that I can't change the sort when I'm in table view. I click date and the little arrow will change direction, but all the rows stay in the same place. Sorting on all the other fields works fine though. So, with all this in mind: 1) How do make the date column sortable? 2) Is the way I'm doing this correct, or is there a better method that I can use? ... View more

I'm trying to figure out why anyone would want to create a dashboard in Splunk. Views allow you to add forms along with any charts and searches, while dashboards only show static charts. So, why would I want to make a dashboard? Is there any advantage of one vs the other? ... View more