Alerting

Alert if number of dropped Packets is 3*baseline

soesia12
New Member

Hey!
I'm trying to create an alert that triggeres if the count of dropped/denied/blocked packets within one day is three times average count of dropped packets in the last 3 weeks.

The search for the packets dropped in the last 24 hours:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=1d | eventstats count(status) AS statcount BY _time | table statcount | dedup statcount

The search for the average packets dropped in the last 3 weeks per day:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=3w | eventstats count(status) AS statcount BY _time | eval packs = statcount/21  | table packs | dedup packs

So my question is how can i trigger an alert if the result of the first search is 3 times higher than the result of the second search.

Thanks,
S.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll need to do both calculations in one go, something like this:

 sourcetype=syslog (status="deny" OR status="blocked" OR status="dropped") | timechart span=1d count

That gives you a daily count. Now you can get the average and bottom value by appending this:

... | stats avg(count) as avg last(count) as last

From that, you can do whatever maths and filtering you like with eval and where.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You'll need to do both calculations in one go, something like this:

 sourcetype=syslog (status="deny" OR status="blocked" OR status="dropped") | timechart span=1d count

That gives you a daily count. Now you can get the average and bottom value by appending this:

... | stats avg(count) as avg last(count) as last

From that, you can do whatever maths and filtering you like with eval and where.

martin_mueller
SplunkTrust
SplunkTrust

Set the time range to the last three weeks.

0 Karma

soesia12
New Member

Hey! Thank you.

It seemed to work, but how do i specify that the average taken from the last 3 weeks?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@soesia12 - Did the answer provided by martin_mueller help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...