https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388749#M113356 <P>That worked. Thank you.</P> Tue, 16 Jul 2019 15:06:20 GMT vallurupallic 2019-07-16T15:06:20Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388745#M113352 <P>The following splunk search is what I'm using to construct the dynamic threshold of a alert I want to create:</P> <PRE><CODE>sourcetype=my_sourceearliest=-28d | eval dayofweek = strftime(_time,"%A") | eval today=strftime(now(),"%A") | eval eventHour=strftime(_time,"%H") | eval eventMin=strftime(_time,"%M") | eval curHour=strftime(now(),"%H") | eval curMin=strftime(now(),"%M") | where dayofweek=today AND eventHour=curHour AND curMin &gt; eventMin AND (eventMin &gt; curMin-5) | bucket _time span=1d | stats count by _time | stats avg(count) as dynThreshold | eval dynThreshold=(1.3*dynThreshold) </CODE></PRE> <P>Now I want to create a alert where the result count is greater than the dynThreshold value constructed above. can someone help with this please.</P> Mon, 15 Jul 2019 20:44:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388745#M113352 vallurupallic 2019-07-15T20:44:10Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388746#M113353 <P>try this anywhere:</P> <PRE><CODE>| gentimes start=-28 increment=1h | eval _time = starttime | eval random_value = random()%200 | eval dayofweek = strftime(_time,"%A") | eval today=strftime(now(),"%A") | eval eventHour=strftime(_time,"%H") | eval eventMin=strftime(_time,"%M") | eval curHour=strftime(now(),"%H") | eval curMin=strftime(now(),"%M") | where dayofweek=$today$ AND eventHour=curHour AND curMin &gt; eventMin AND (eventMin &gt; curMin-15) | bucket _time span=1d | stats avg(random_value) as avg_ran by _time | eventstats avg(avg_ran) as dynThreshold | eval dynThreshold=(1.3*dynThreshold) | eval alert = if(avg_ran &gt; dynZThreshold,1,0) </CODE></PRE> <P>i changed <CODE>... AND (eventMin &gt; curMin-5</CODE> to <CODE>... &gt; curMin-15</CODE> to make sure you will see results</P> <P>hope it helps</P> Tue, 16 Jul 2019 00:11:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388746#M113353 adonio 2019-07-16T00:11:27Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388747#M113354 <P>im trying to substitute the use of random value above with the search query result set. But im not able to find any results. I tried the search query just after gentimes as gentimes need to be the first command. can you help please</P> Tue, 16 Jul 2019 14:44:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388747#M113354 vallurupallic 2019-07-16T14:44:33Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388748#M113355 <P>the <CODE>| gentimes</CODE> is an example<BR /> use your search </P> <P>sourcetype=my_sourceearliest=-28d <BR /> | eval dayofweek = strftime(_time,"%A")<BR /> | eval today=strftime(now(),"%A")<BR /> | eval eventHour=strftime(_time,"%H") <BR /> | eval eventMin=strftime(_time,"%M")<BR /> | eval curHour=strftime(now(),"%H") <BR /> | eval curMin=strftime(now(),"%M")<BR /> | where dayofweek=today AND eventHour=curHour AND curMin &gt; eventMin AND (eventMin &gt; curMin-5) <BR /> | bucket _time span=1d<BR /> | stats count as tot_count by _time <BR /> | eventstats avg(tot_count) as dynThreshold<BR /> | eval dynThreshold=(1.3*dynThreshold)<BR /> | eval alert = if(tot_count &gt; dynZThreshold,1,0)</P> Wed, 30 Sep 2020 01:19:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388748#M113355 adonio 2020-09-30T01:19:15Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388749#M113356 <P>That worked. Thank you.</P> Tue, 16 Jul 2019 15:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-value-of-a-dynamic-threshold-constructed-as-a/m-p/388749#M113356 vallurupallic 2019-07-16T15:06:20Z