topic How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted. in Alerting

How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted.

ngwodo — Wed, 23 Dec 2020 17:09:12 GMT

I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility" Here it is:

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)

Re: How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted

burwell — Wed, 23 Dec 2020 17:29:57 GMT

How about something like this

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | timechart span=1day count | timechart span=1month earliest(count) AS count | eventstats avg(count)as avg max(count) as max min(count) as min | where count = max

.. change stats -> eventstats and then do some kind of comparison

Re: How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted

ngwodo — Mon, 28 Dec 2020 15:17:31 GMT

Thanks. That was part of the answer. The splunk query I was looking for is: