Hi all,
I need to calculate the standard deviation value using previous 5mins of data and have to recalculate every 5 mins.. After getting the result, I need to use that calculated standard deviation value as a threshold value for upcoming data for 5mins. if the upcoming data is more than threshold, I need to trigger alert. How can I do about it?
Here is my search:
1. Calculate standard devi
source="tcp:9996" index="data" sourcetype="xml" earliest=-10m latest=-5m|stats avg(Ch3) as alpha stdev(Ch3) as sd|eval temp=sd|eval sigma=temp*3
2. check the value
source="tcp:9996" index="data" sourcetype="xml" streamstats current=false values(Ch3) as curVal |table _time curVal|where curVal>sigma
I do not know how to combine this 2 search as I cannot access sigma from search 2.
... View more