Alerting

How to create a real-time alert to trigger if the max value of the current day is double the max value of the previous day?

Makinde
New Member

Hi All,

I have a search string to identify size of data sent out the network. I would like to create an alert to notify me when the size of data sent out the network doubles the max value of the previous data, however, I want the days to be rolling such that on Monday, the max data sent out on Sunday is used and on Tuesday, the max data sent out on Monday is used and the process continues.

I do know how to create alerts, but including the rolling day logic is what I don't know how to do as well as specify the double factor, I would like to do same for averages too, I am guessing the logic will be the same.

Thanks,

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...