Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Splunk Search Query - Detect Above Average Activity Using Standard Deviation
tag=firewall action=deny
| stats count values(dst) by src
| eventstats avg(count) as avg_count
| eval standard_deviation=count/avg_count
| fields - count, avg_count
| search standard_deviation > 10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment