I need to locate and alert on counts that are not within predicted bounds. It seems simple enough using predict, but predict does not include any information regarding the source. Here is a run anywhere search which illustrates my concern
index=_internal sourcetype=splunkd_access* | timechart span=1d count as Gets | predict Gets | eval queueManager=if(1=1, mq_ir360_qmgr,"no") | rename upper95(prediction(Gets)) as ceiling | rename lower95(prediction(Gets)) as floor | eval excession=if(Gets > ceiling, "100", "0") | eval recession=if(Get < floor, "-100", "0") | table _time Gets, sourcetype
As you can see, there is no mention of the sourcetype in the results. I plan to use this within a map loop to check thousands of different hosts and I need to know which host contains an outlier. I tried to add information, but it is not in the pipe, so I can't(see second example) .
How would I get the sourcetype in my output?
![alt text][1]
[1]: /storage/temp/86183-1-22-2016-4-00-45-pm.png
↧