Hello all, I am looking at endpoint data and I want to see if I can make a search query to look at certain commands that are run in fairly quick succession, say a minute or two. Essentially, someone running cp, then chown, then using kextcache or something of that nature. The idea is to gather results of people performing these commands right after another or within a minute or so to see someone trying to install something malicious. I saw another post talking about streamstats but it doesn't seem to work the way I want it. To be honest, I don't have much of a query yet so I would appreciate any input that could describe how to do this. Thanks ... View more

Hello, I am trying to find outliers on a graph by using the median absolute deviation on a graph. I know that the machine learning toolkit for splunk can do this but I'm not using that right now. Essentially, we have the count of ip addresses over time because we are tracking how many times this ip address generates an event. So we have this count value plotted over time. I need to calculate the median absolute deviation and for some reason it doesn't seem to be able to get the median of this. It seems to grab one of the bigger count values as the median even if this value only shows once. There are clearly other values which should be selected as the median yet they were not. (The first column in the table is the count values. There is more than shown but it is clear that 1209 is an outlier, and should not be the median) index=data sourcetype=json seen.indicator=X.X.X.X | bin _time span=30m | eventstats count(seen.indicator) as "Count" by _time | eventstats values(Count) as valu | eventstats count(valu) as help by _time | eventstats median(Count) as med | eval newValue = abs(Count-med) | eventstats median(newValue) as medianAbsDev by seen.indicator | eval upper = med+(medianAbsDev*1.2) | eval lower = med-(medianAbsDev*1.2) | eval isOutlier=if(Count < lower OR Count > upper, 1, 0) | timechart span=30m count(seen.indicator) as CountOfIndicator, eval(values(upper)) as upperl, eval(values(lower)) as lowerl, eval(values(isOutlier)) as Outliers by seen.indicator usenull=f useother=f | filldown ... View more

Hello all, I am fairly new to the Splunk Community and have been learning a lot over the past few weeks. Currently, my team is building a dashboard based on sensor data that can help us tune our sensors further. Essentially, we are creating a line chart for each sensor IP address (using trellis if that helps) based on the count (of seeing this sensor) every 5 minutes or so using bins and charts. We currently have standard deviation lines based on each count with some sensitivity. The idea is that we have a window between the two lines. This is demonstrating some "normal" traffic. This will help us show outliers and could give us some different insight over time (we would like to eventually be able to compare this data with much earlier data). In any case, I am having trouble outlining the outliers that are clearly represented in the chart that is shown. And my line in the search to identify outliers just identifies them all as outliers which is incorrect... I'm unsure of what I am doing wrong and also see how much of a pain it is the track count over time as a variable and be able to do things with it (such as the outliers) and such. A side issue is that when the count is 0 (meaning the sensor didn't show up) the standard deviation line also is just missing represented with a null value. Anyway, I can make the graph look prettier and have it just go along with the rest of the line? So, questions are as follow: - How can I clearly show the outliers? Highlight them? Maybe even color in the area under or over between the outlier and standard deviation line? - How can I fix my standard deviation line so there isn't blanks? index=networkdata sourcetype=json | bin _time span=5m | eventstats count(seen.indicator) as "Count" by seen.indicator _time | eventstats avg(Count) as "newAVG" by seen.indicator | eventstats stdev(Count) as "newSTD" by seen.indicator | eval upper = newAVG+(newSTD*1.5) | eval lower = newAVG-(newSTD*1.5) | eval isOutlier=if("Count" < lower OR "Count" > upper, 1, 0) | chart count(seen.indicator) as CON, eval(values(upper)) as upperl, eval(values(lower)) as lowerl over _time by seen.indicator ... View more