How to create a real-time alert to trigger if the max value of the current day is double the max value of the previous day?

[Makinde]

Hi All,

I have a search string to identify size of data sent out the network. I would like to create an alert to notify me when the size of data sent out the network doubles the max value of the previous data, however, I want the days to be rolling such that on Monday, the max data sent out on Sunday is used and on Tuesday, the max data sent out on Monday is used and the process continues.

I do know how to create alerts, but including the rolling day logic is what I don't know how to do as well as specify the double factor, I would like to do same for averages too, I am guessing the logic will be the same.

Thanks,

[somesoni2 · Accepted solution]

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday