Splunk - Statistical Analysis Example

# Select the search space (index, sourcetype, eventtypes, ...) and basic filters (ip, range, ...)
index=* sourcetype="my_super_ids" src!=64.39.96.0/20

# Optional - Reduce the number of event types (optional).
| eval action=case(action="allowed", "allowed", action="blocked", "blocked", true(), "not_allowed")

# Group the results over the required dimensions (usually source/destination/action).
| stats count(action) as action_count by src, dest, action

# Reduce the dimensions count to facilitate the analysis.
| eval event=src + ":" + dest
| xyseries event action action_count

# Calculate the statistical values over the numerical dimension.
# The '10' in the formula 'avg-stdev*10' is the sensitivity we want to use to select only the highest or lowest outlying values.
| streamstats avg(blocked) as avg stdev(blocked) as stdev
| eval blocked_lb=(avg-stdev*10)
| eval blocked_ub=(avg+stdev*10)

# Filter to keep only the outliers.
| where blocked > blocked_ub

# Format the final results.
| table event allowed blocked not_allowed