I don't want information about Prelert Anomaly Detection...I've already asked about purchasing that app, but I still have a need to get an alert in place today....
I've got a search that works well for my needs, but I'm not sure how to apply an alert to it.
Will standard deviation be affected by how far back I search? I want to schedule this to run every 15 minutes, but I want to ensure the standard deviation has a large enough sample size. Currently I'm searching back 7 days.
host=myServer source="mySource" earliest=-7d@d latest=now|eval Hour=strftime(_time, "%m-%d-%y %H:%M:%S")|stats sum(servfail) as "ServFail responses", stdevp(servfail) as standdev by Hour | eval two = 2* standdev
If I set an alert to run every 15 minutes with the above search, will I get an alert for an event until that alert is outside of the -7days timeframe?
1 - If you data volume is not huge you should be able to apply this logic:
https://answers.splunk.com/answers/48205/comparing-todays-data-with-last-weeks-data.html
2 - Timewrap might be useful and easy to use too:
https://answers.splunk.com/answers/60295/comparing-time-ranges-one-report.html
3 - summary indexes (or a data model too) will give you a lot more control but it's obviously slightly more complicated to implemented:
Hope that helps.
Thanks,
J