Alerting

How to create a real-time alert to trigger if the max value of the current day is double the max value of the previous day?

Makinde
New Member

Hi All,

I have a search string to identify size of data sent out the network. I would like to create an alert to notify me when the size of data sent out the network doubles the max value of the previous data, however, I want the days to be rolling such that on Monday, the max data sent out on Sunday is used and on Tuesday, the max data sent out on Monday is used and the process continues.

I do know how to create alerts, but including the rolling day logic is what I don't know how to do as well as specify the double factor, I would like to do same for averages too, I am guessing the logic will be the same.

Thanks,

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...