Alerting

Alert if number of dropped Packets is 3*baseline

soesia12
New Member

Hey!
I'm trying to create an alert that triggeres if the count of dropped/denied/blocked packets within one day is three times average count of dropped packets in the last 3 weeks.

The search for the packets dropped in the last 24 hours:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=1d | eventstats count(status) AS statcount BY _time | table statcount | dedup statcount

The search for the average packets dropped in the last 3 weeks per day:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=3w | eventstats count(status) AS statcount BY _time | eval packs = statcount/21  | table packs | dedup packs

So my question is how can i trigger an alert if the result of the first search is 3 times higher than the result of the second search.

Thanks,
S.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll need to do both calculations in one go, something like this:

 sourcetype=syslog (status="deny" OR status="blocked" OR status="dropped") | timechart span=1d count

That gives you a daily count. Now you can get the average and bottom value by appending this:

... | stats avg(count) as avg last(count) as last

From that, you can do whatever maths and filtering you like with eval and where.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You'll need to do both calculations in one go, something like this:

 sourcetype=syslog (status="deny" OR status="blocked" OR status="dropped") | timechart span=1d count

That gives you a daily count. Now you can get the average and bottom value by appending this:

... | stats avg(count) as avg last(count) as last

From that, you can do whatever maths and filtering you like with eval and where.

martin_mueller
SplunkTrust
SplunkTrust

Set the time range to the last three weeks.

0 Karma

soesia12
New Member

Hey! Thank you.

It seemed to work, but how do i specify that the average taken from the last 3 weeks?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@soesia12 - Did the answer provided by martin_mueller help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...