scoreSpikes

Score events based on spikes in values.

Scores events in the input table according to whether the specified column (a double) has a spike. The scores are higher for events that with a spike in the specified column.

Operator Usage in Easy Mode

  1. Click + on the parent node.
  2. Enter the Score Spikes operator in the search field and select the operator from the Results to open the operator form.
  3. In the Input Table drop-down, enter or select the name of the table containing the data to run this operator on.
  4. In the Column drop-down, enter or select a column to detect spikes over time.
  5. Click Run to view the result.
  6. Click Save to add the operator to the playbook.
  7. Click Cancel to discard the operator form.

Usage Details

scoreSpikes(inputTable, column)

Example

Input

lhub_ts bytes_in
02/04/2018 06:40:00256
02/04/2018 06:41:00256
02/04/2018 06:42:00256
02/04/2018 06:43:00256
02/04/2018 06:44:001028
02/04/2018 06:45:001028
02/04/2018 06:46:001028
scoreSpikes(table, "bytes_in")

Output

lhub_ts bytes_in lhub_score
02/04/2018 06:40:002560.0
02/04/2018 06:41:002560.0
02/04/2018 06:42:002560.0
02/04/2018 06:43:002560.0
02/04/2018 06:44:00102810.0
02/04/2018 06:45:0010280.0
02/04/2018 06:46:0010280.0