https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630355#M218993 <P>What I am looking for might be something even simpler. If I can get the total log volume per day and set up a threshold for alerting that will work. I was thinking log volume for most indexes (log sources) do tend to drop on the weekends. Perhaps there is a threshold that can be set up based on the day of the week. Weekends vs week days. Any such way to accomplish this?</P> Thu, 09 Feb 2023 20:00:48 GMT Splunk77 2023-02-09T20:00:48Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630314#M218978 <P>I am trying to monitor drop in events per index. What is the best way to get a baseline and detect deviation to the volume? I am more interesting in drop in events and not increase.</P> Thu, 09 Feb 2023 18:53:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630314#M218978 Splunk77 2023-02-09T18:53:17Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630325#M218982 <P>Start with per_index_thruput in _internal.&nbsp; It's just a sample and has natural ups and downs, but may give you something to work with.</P><LI-CODE lang="markup">index=_internal sourcetype=splunkd source=*metrics.log* group=per_index_thruput</LI-CODE> Thu, 09 Feb 2023 16:41:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630325#M218982 richgalloway 2023-02-09T16:41:51Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630355#M218993 <P>What I am looking for might be something even simpler. If I can get the total log volume per day and set up a threshold for alerting that will work. I was thinking log volume for most indexes (log sources) do tend to drop on the weekends. Perhaps there is a threshold that can be set up based on the day of the week. Weekends vs week days. Any such way to accomplish this?</P> Thu, 09 Feb 2023 20:00:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630355#M218993 Splunk77 2023-02-09T20:00:48Z https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630381#M219001 <P>Check the Monitoring Console to see if it has a query that comes close to what you want.</P><P>As for accounting for weekends and holidays, you probably should look at the Machine Learning Toolkit (MLTK).&nbsp; It has algorithms that can detect trends in your data and help find when the trends break.</P> Fri, 10 Feb 2023 01:14:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-monitor-deviation-to-log-volume/m-p/630381#M219001 richgalloway 2023-02-10T01:14:25Z