Alert when there is a peak of activity

[ctaf]

Hello,

I am currently setting up some graphs and I was wondering if there is a simple and flexible way to generate an alert when there is a unusual peak in the graph.

I know I can set up an alert if X events have been found but this is not flexible. Is there a way that Splunk can learn that, for example, on Mondays, there are more events generated so the alert limit should be higher ?

Thank you !

[woodcock]

You could use timewrap app to compare week-over-week and do a precentage variation that is constant:

https://splunkbase.splunk.com/app/1645/

[ctaf]

Wow, this looks very nice. If you have any other command to compare charts over time, do not hesitate to share it.

[javiergn · Accepted solution]

The way I approached this in the past was using a summary index (report acceleration might work too):

• Summarise your data hourly, daily or whatever range you find more suitable for your needs
• Apply the relevant statistical functions to your summary data (doing the same against non-summarised data could take ages)
• Compare your previous results with your current ones in order to trigger the alerts you want

I don't have access to my old Splunk instance at the moment so I can't really paste any code or screenshots.

Hope that helps.

Thanks,
J

[jeffland]

You could also check out the Machine Learning App which features one such use cases explicitly. Check it out if you're interested, I can really recommend it!

[ctaf]

Thank you. I will check out this app 🙂