https://community.splunk.com/t5/Alerting/Requesting-help-to-create-an-alert-as-below/m-p/442090#M7740 <P>there are many answers for this topic in this portal, here are some examples:<BR /> <A href="https://answers.splunk.com/answers/716733/how-do-you-calculate-the-growth-of-each-index-on-a.html">https://answers.splunk.com/answers/716733/how-do-you-calculate-the-growth-of-each-index-on-a.html</A><BR /> <A href="https://answers.splunk.com/answers/231310/calculating-the-percentage-growth-value-of-a-field.html">https://answers.splunk.com/answers/231310/calculating-the-percentage-growth-value-of-a-field.html</A><BR /> and also many ways to calculate the size and growth of an index ...<BR /> here is a quick draw, i hope you will find it useful:</P> <PRE><CODE>index=_internal source=*license_usage.log type="Usage" idx IN(proxy Dns windows Linux Firewall) | bin _time span=1d | eventstats sum(b) as daily_b by idx _time | eval daily_mb = daily_b/1024/1024 | stats max(daily_mb) as total_daily by _time idx | streamstats window=30 current=f global=f avg(total_daily) as running_avg by idx | eval ten_percent_on_top = running_avg + running_avg/10 | eval flag = if(total_daily&gt;ten_percent_on_top,"Alarm","All Good") </CODE></PRE> <P>note, this search can get expensive as the data is verbose. its recommended to summarize your daily license stats and query the summary index with the data </P> Wed, 26 Jun 2019 17:18:47 GMT adonio 2019-06-26T17:18:47Z https://community.splunk.com/t5/Alerting/Requesting-help-to-create-an-alert-as-below/m-p/442089#M7739 <P>Hi,</P> <P>Please can some one help me t create the alert for below requirement.</P> <P>"For the following indexes below, create an alert that monitors license volume exceeding 10% of the rolling average of the last 30 days of volume.</P> <P>1 proxy<BR /> 2 Dns<BR /> 3 windows<BR /> 4 Linux<BR /> 5 Firewall"</P> Wed, 26 Jun 2019 05:12:39 GMT https://community.splunk.com/t5/Alerting/Requesting-help-to-create-an-alert-as-below/m-p/442089#M7739 x1045866 2019-06-26T05:12:39Z https://community.splunk.com/t5/Alerting/Requesting-help-to-create-an-alert-as-below/m-p/442090#M7740 <P>there are many answers for this topic in this portal, here are some examples:<BR /> <A href="https://answers.splunk.com/answers/716733/how-do-you-calculate-the-growth-of-each-index-on-a.html">https://answers.splunk.com/answers/716733/how-do-you-calculate-the-growth-of-each-index-on-a.html</A><BR /> <A href="https://answers.splunk.com/answers/231310/calculating-the-percentage-growth-value-of-a-field.html">https://answers.splunk.com/answers/231310/calculating-the-percentage-growth-value-of-a-field.html</A><BR /> and also many ways to calculate the size and growth of an index ...<BR /> here is a quick draw, i hope you will find it useful:</P> <PRE><CODE>index=_internal source=*license_usage.log type="Usage" idx IN(proxy Dns windows Linux Firewall) | bin _time span=1d | eventstats sum(b) as daily_b by idx _time | eval daily_mb = daily_b/1024/1024 | stats max(daily_mb) as total_daily by _time idx | streamstats window=30 current=f global=f avg(total_daily) as running_avg by idx | eval ten_percent_on_top = running_avg + running_avg/10 | eval flag = if(total_daily&gt;ten_percent_on_top,"Alarm","All Good") </CODE></PRE> <P>note, this search can get expensive as the data is verbose. its recommended to summarize your daily license stats and query the summary index with the data </P> Wed, 26 Jun 2019 17:18:47 GMT https://community.splunk.com/t5/Alerting/Requesting-help-to-create-an-alert-as-below/m-p/442090#M7740 adonio 2019-06-26T17:18:47Z