https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22008#M3721 <P>I'm trying to run a similar search looking at decline rates for a payment gateway. I want to look at the current decline rate average trend line and also the running average trendline. </P> <P>tried doing something similar but ended up getting Mismatched ']' when I ran my query.</P> <P>gateway=firstdata errorType=declined event=transaction Completed earliest=-1h@h latest=@h | bucket _time span=1h | stats count as hourlyCount by _time | appendcols { search searchforerrors earliest=-7d@d latest=-1h@h | bucket _time span=1h | stats count by _time | stats avg(count) as average ] |where hourlyCount &gt; average</P> <P>Any idea why? </P> Wed, 09 Mar 2016 22:11:07 GMT mhamano 2016-03-09T22:11:07Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22005#M3718 <P>Is there any way to do this in a single search? I know it can be done by having one search compute the moving average of the field and then write that to a lookup table. A subsequent search would then compute the value for the time period and see if it is above the value in the lookup table.</P> <P>Is there any way to do it with a single search that doesn't require a lookup table?</P> <P>Thx.</P> <P>Craig</P> Fri, 02 Nov 2012 19:38:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22005#M3718 responsys_cm 2012-11-02T19:38:33Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22006#M3719 <P>Let me make this more specific, so that i can show an example. Every hour, I want to compare the number of errors from the past hour with the average number of errors for the past week. If the hourly count &gt; the average count, then trigger an alert.</P> <P>This search will do</P> <PRE><CODE>searchforerrors earliest=-1h@h latest=@h | bucket _time span=1h | stats count as hourlyCount by _time | appendcols { search searchforerrors earliest=-7d@d latest=-1h@h | bucket _time span=1h | stats count by _time | stats avg(count) as average ] | where hourlyCount &gt; average </CODE></PRE> <P>Schedule this search to run once each hour and to trigger if the number of results is greater than zero.</P> Sat, 03 Nov 2012 07:53:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22006#M3719 lguinn2 2012-11-03T07:53:45Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22007#M3720 <P>actually <CODE>trendline</CODE> or the <CODE>streamstats</CODE> commands will let you do this fairly easily, but really it's hard to say what works for you unless we know how you are averaging your data.</P> Mon, 05 Nov 2012 05:55:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22007#M3720 gkanapathy 2012-11-05T05:55:31Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22008#M3721 <P>I'm trying to run a similar search looking at decline rates for a payment gateway. I want to look at the current decline rate average trend line and also the running average trendline. </P> <P>tried doing something similar but ended up getting Mismatched ']' when I ran my query.</P> <P>gateway=firstdata errorType=declined event=transaction Completed earliest=-1h@h latest=@h | bucket _time span=1h | stats count as hourlyCount by _time | appendcols { search searchforerrors earliest=-7d@d latest=-1h@h | bucket _time span=1h | stats count by _time | stats avg(count) as average ] |where hourlyCount &gt; average</P> <P>Any idea why? </P> Wed, 09 Mar 2016 22:11:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22008#M3721 mhamano 2016-03-09T22:11:07Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22009#M3722 <P>I'm trying to run a similar search looking at decline rates for a payment gateway. I want to look at the current decline rate average trend line and also the running average trendline. </P> <P>tried doing something similar but ended up getting Mismatched ']' when I ran my query.</P> <P>gateway=firstdata errorType=declined event=transaction Completed earliest=-1h@h latest=@h | bucket _time span=1h | stats count as hourlyCount by _time | appendcols { search searchforerrors earliest=-7d@d latest=-1h@h | bucket _time span=1h | stats count by _time | stats avg(count) as average ] |where hourlyCount &gt; average</P> <P>Any idea why? </P> Wed, 09 Mar 2016 22:11:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-on-a-value-crossing-over-a-moving-average-of-that/m-p/22009#M3722 mhamano 2016-03-09T22:11:29Z