scoreSpikes

Scores events in the input table according to whether the specified column (a double) has a spike. The scores are higher for events that with a spike in the specified column.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Score Spikes operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the name of the table containing the data to run this operator on.
4. In the Column drop-down, enter or select a column to detect spikes over time.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

scoreSpikes(inputTable, column)

Example

Input

LQL command

scoreSpikes(table, "bytes_in")

Output