https://community.splunk.com/t5/Splunk-Search/Unusually-high-volume-detection-with-respect-to-the-same-day-of/m-p/392046#M171044 <P>It would be possible to detect an increase in volume per server.</P> <P>This is my current search that looks global but would need one per server without having to create 100 search one by src_Ip = ...</P> <PRE><CODE>index=cisco_asa sourcetype="cisco:asa" Cisco_ASA_action=allowed earliest=-1w | timechart count span=1d perc95(avg) | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap w | rename "* ago" as * | eval avg=Total/3.0 | rename latest_week as Today 1week_before as Lastday _time as Date | eval ChangePercent = (Today - Lastday) / 100 | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(Date) | where ChangePercent &gt; 0.20 </CODE></PRE> <P>Thank you!</P> Mon, 27 May 2019 16:38:02 GMT christianubeda 2019-05-27T16:38:02Z https://community.splunk.com/t5/Splunk-Search/Unusually-high-volume-detection-with-respect-to-the-same-day-of/m-p/392046#M171044 <P>It would be possible to detect an increase in volume per server.</P> <P>This is my current search that looks global but would need one per server without having to create 100 search one by src_Ip = ...</P> <PRE><CODE>index=cisco_asa sourcetype="cisco:asa" Cisco_ASA_action=allowed earliest=-1w | timechart count span=1d perc95(avg) | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap w | rename "* ago" as * | eval avg=Total/3.0 | rename latest_week as Today 1week_before as Lastday _time as Date | eval ChangePercent = (Today - Lastday) / 100 | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(Date) | where ChangePercent &gt; 0.20 </CODE></PRE> <P>Thank you!</P> Mon, 27 May 2019 16:38:02 GMT https://community.splunk.com/t5/Splunk-Search/Unusually-high-volume-detection-with-respect-to-the-same-day-of/m-p/392046#M171044 christianubeda 2019-05-27T16:38:02Z https://community.splunk.com/t5/Splunk-Search/Unusually-high-volume-detection-with-respect-to-the-same-day-of/m-p/392047#M171045 <P>Is this same question as <A href="https://answers.splunk.com/answers/748738/cisco-asa-volume-detection-today-against-same-day.html">https://answers.splunk.com/answers/748738/cisco-asa-volume-detection-today-against-same-day.html</A> ?<BR /> If not, you could do it very similar to the above question</P> Mon, 27 May 2019 19:38:13 GMT https://community.splunk.com/t5/Splunk-Search/Unusually-high-volume-detection-with-respect-to-the-same-day-of/m-p/392047#M171045 koshyk 2019-05-27T19:38:13Z