Hi Community, i solved the problem with outlier detection... thx all for your support 🙂 source="/var/log/livingroom.json" | streamstats window=60 current=true avg("temperature_celsius") as avg stdev("temperature_celsius") as stdev | eval lowerBound=(avg-stdev*exact(5)), upperBound=(avg+stdev*exact(5)) | eval isOutlier=if('temperature_celsius' < lowerBound OR 'temperature_celsius' > upperBound, 1, 0) | where isOutlier=0 | timechart eval(round(avg('temperature_celsius'),1)) AS "Temperature"   ... View more

If you look at the sceenshot... my goal is to get the values between the 10 and 20, but ignore / delete the outlier with -9,4 (faulty value from sensor), which is to see on the absolute min max graph... in the timechart you see that as litte edge... The sensor puts every minute a value 24/7. With "timechart" curve you wont see the small number of outlier by 1440 values, but in the "stats" min max per day, you will see extreme values like the -9,4, which is absolutly unlogical by a minimum average from ~10. In order to know which of the Min Max of the day is wrong / outlier, I came up with the idea of ​​verifying the values ​​using the timechart Min Max, that was my idea... I hope it is understandable 😉 ... View more

Here is a actual  problem sample... good to see by outlier with -9.4 ... View more

Do you have a SPL Code hint for me? 😉 ... View more

Hi, delete ist not a mus have... to exclude the vaulty results to the search is another option... My logig: timechart avg > get the avg min and avg max from this timechart > exclude events with the min max avg > new timechart ... View more

The solution from yuanliu works, but not for the full json file from https://forecast.solar/ The best way was to use regex field extractor, but... ...next step to get timecharts from this format wont work by regex { "result": { "watts": { "2019-06-22 05:15:00": 17, "2019-06-22 05:30:00": 22, "2019-06-22 05:45:00": 27, ... "2019-06-29 20:15:00": 14, "2019-06-29 20:30:00": 11, "2019-06-29 20:45:00": 7 }, "watt_hours": { "2019-06-22 05:15:00": 0, "2019-06-22 05:30:00": 6, "2019-06-22 05:45:00": 12, ... "2019-06-29 20:15:00": 2545, "2019-06-29 20:30:00": 2548, "2019-06-29 20:45:00": 2550 }, "watt_hours_day": { "2019-06-22": 2626, "2019-06-23": 2918, "2019-06-24": 2526, "2019-06-25": 2866, "2019-06-26": 2892, "2019-06-27": 1900, "2019-06-28": 2199, "2019-06-29": 2550 } }, "message": { "type": "success", "code": 0, "text": "" } }   ... View more

Looks plausible. I ll test it, and get feedback to you in a month ! ... View more

"Source A" to Data Collector 01  > IDX Cluster 01 for Data A | (Data Copy from Source A for Cluster 02) | |---> "Source B" to Data Collector 02 > IDX Cluster 02 for Data A and B THX for the link, my config is similar, but... the "Data A" Copy from DC01 direct to IDX Cluster 02 works fine, "Data A" Copy from DC01 to DC02 to IDX Cluster 02 not... Any idea? Is "Data HF hopping" 😉 even possible? Without transforms and props directly via tcp-out over inputs.conf it worked... ... View more

Hi, i have a similar problem... at first my config to forward internal splunk indexes... [tcpout] forwardedindex.0.whitelist = _.* forwardedindex.filter.disable = false defaultGroup = TEST_IDX-CLUSTER [tcpout:TEST_IDX-CLUSTER] forceTimebasedAutoLB = true autoLBFrequency = 30 server = ID01.SPLUNK-TEST.local:9997,ID02.SPLUNK-TEST.local:9997,ID03.SPLUNK-TEST.local:9997 Then i debug with this search... index="_internal" | eval bucket=_bkt | eval indextime=_indextime | table _time, indextime, bucket splunk_server _raw | convert ctime(indextime) | stats count list(*) as * by _raw | where count>1 | fields * _raw | sort - indextime Output: bucket = every bucket is another in one event count = 2 or sometimes 3 indextime = every entry is equal splunk_server = 01,02,03 or 01,01 or 02,03 or 03,03 (many different combinations) Anyone an idea? Regards - Markus ... View more