Grouping Events by Both Time and Customer

DGray — Wed, 05 Jul 2017 14:55:05 GMT

Hi all,

Want to alert when a customer's usage suddenly drops.

Tried breaking recent usage into two time periods:
- "new" events (the previous 10 minutes)
- "old" events (the 10 minutes before that)

If there are 100 more "old" events than "new" events, I want to raise an alert.
I have tried several approaches, and found the problem unexpectedly tricky. Please help.

note: All events have a "customer" field, which is one of a couple hundred values. It should be possible to have one query that checks all customers, and returns those that have problems.

sourcetype=web | eval kind = case(_time>now()-600, "new", _time>now()-1200, "old", true(), "out of scope") | stats count by customer, kind | .... something??

Re: Grouping Events by Both Time and Customer

somesoni2 — Wed, 05 Jul 2017 15:19:48 GMT

Try like this

sourcetype=web earliest=-20m@m 
| eval period=if(_time>=relative_time(now(),"-10m@m"),"new","old") 
| chart count over customer by period
| where old-new>100

Re: Grouping Events by Both Time and Customer

DGray — Wed, 05 Jul 2017 15:27:42 GMT

Thanks, this works great!

topic Re: Grouping Events by Both Time and Customer in Splunk Search

Grouping Events by Both Time and Customer

Re: Grouping Events by Both Time and Customer

Re: Grouping Events by Both Time and Customer