topic Re: When the following search sees a percentage increase, can you help me create an alarm on it? in Alerting

When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 09:46:40 GMT

Hi, I have a search that looks like this:

index=loadbalancer r_host="sport.mtm.com"  req="/api/v2/log/exception"

Now, I want to create an alarm on it. I want it to alarm when it sees a percentage increase.

Can anyone help me?

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 10:06:10 GMT

Hello @amirasalan

Is there percentage field available in data?

Or you want based on no of events per minutes or hour etc?

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 10:15:12 GMT

Hi @vishaltaneja07011993

I want it on number on event per hour. But i only want alert when it sees a percentage increase.

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 11:21:55 GMT

Try something:

index=* earliest=-2h latest=-1h | stats count | appendcols [ search index=* earliest=-1h latest=now() | stats count as count2] | eval perc= round(((count2 - count) * 100 / count),2) | fields + perc | search perc < 0

Now you can create a alert based on the above search.

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 11:41:08 GMT

I don't receive any results, should it be like that? and the other question is what value should i use when i create the alert on the trigger conditions? see the link picture
https://www.google.com/search?q=create+alert+splunk&rlz=1C1GCEB_enSE814SE814&source=lnms&tbm=isch&sa=X&ved=0ahUKEwjukq2ZzLPgAhWRw8QBHbqDCN4Q_AUIDygC&biw=1920&bih=1089#imgrc=KIRBOVpLoeKTFM:

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 11:45:12 GMT

I only see events not statistic

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 12:31:55 GMT

index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception"  earliest=-2h latest=-1h | stats count | appendcols [ search index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception"  earliest=-1h latest=now() | stats count as count2] | eval perc= round(((count2 - count) * 100 / count),2) | fields + perc | search perc < 0

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 12:32:12 GMT

Did you try this?

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 12:42:58 GMT

Now i got results -100,00
I believe its right.
How do I create alert on that

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 12:49:33 GMT

You can save the search as Alert.

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 12:59:17 GMT

Thanks, i'm i kind of newbee hehe. in Trigger Conditions what value should i put

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 13:16:26 GMT

You can put the condition when number of results is more than 0.

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 13:35:45 GMT

Okey i will do that. Last question, so the alert will trigger when its sees a big percentage increase. I forgot to mention that. I want it to trigger when it's a big percentage increase

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 13:38:23 GMT

Okay at what percentage you want alert?

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 13:58:38 GMT

50 % at least

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Tue, 29 Sep 2020 23:12:24 GMT

try this then:
index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception" earliest=-2h latest=-1h | stats count | appendcols [ search index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception" earliest=-1h latest=now() | stats count as count2] | eval perc= round(((count2 - count) * 100 / count),2) | fields + perc | search perc < 50

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 14:40:21 GMT

Perfect should i still use "number of results is more than 0."

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 14:44:02 GMT

@amirarsalan
Try this:

index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception" earliest=-2h latest=-1h | stats count | appendcols [ search index=loadbalancer r_host="sport.mtm.com" req="/api/v2/log/exception" earliest=-1h latest=now() | stats count as count2] | eval perc= round(((count2 - count) * 100 / count),2) | fields + perc | search perc < 50

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

vishaltaneja070 — Mon, 11 Feb 2019 14:44:14 GMT

Yup correct.

please accept the answer so that thread can be closed

Re: When the following search sees a percentage increase, can you help me create an alarm on it?

amirarsalan — Mon, 11 Feb 2019 14:49:57 GMT

Thanks a lot