- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Need search help
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I have a search that timecharts useragent count by useragent. Simply
index=apache useragent=* | timechart count by useragent limit=100
what I would like to do is overlay a lower boundary so if the count in part of this span is lower than the boundary send an alert.
I tried this several different ways.
This was my last attempt:
index=apache* useragent=* | stats count as TotalCount, avg(TotalCount) AS AvgCount, perc5(TotalCount) by _time, useragent
Unfortunately I only get a TotalCount and nothing more.
Any ideas?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.
index=apache* useragent=*
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Give this a try. This query will return result if the count value is lower than the 5 percentile value of the count.
index=apache* useragent=*
| stats count as TotalCount by _time, useragent
| eventstats avg(TotalCount) AS AvgCount, perc5(TotalCount) as perc5Count
| where count < perc5Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Haha was just gettign there myself:
index=apache* useragent=* | timechart count by useragent | eventstats perc5(count) as Lower by useragent
was close at least.
Small changes
Introducing the Splunk Community Dashboard Challenge!
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Wondering How to Build Resiliency in the Cloud?
