Alerting

How to create a real-time alert to trigger if the max value of the current day is double the max value of the previous day?

Makinde
New Member

Hi All,

I have a search string to identify size of data sent out the network. I would like to create an alert to notify me when the size of data sent out the network doubles the max value of the previous data, however, I want the days to be rolling such that on Monday, the max data sent out on Sunday is used and on Tuesday, the max data sent out on Monday is used and the process continues.

I do know how to create alerts, but including the rolling day logic is what I don't know how to do as well as specify the double factor, I would like to do same for averages too, I am guessing the logic will be the same.

Thanks,

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Firstly, I would suggest refraining from real-time alerts, but instead run them at more frequent interval (say every 5min based on your alert tolerance limit).
Second, try something like this to compare current day with previous day (dynamic time range) (run anywhere sample search)

index=_internal sourcetype=splunkd group=per_index_thruput earliest=-1d@d latest=now() | timechart max(kb) as kb | untable _time metric value | eval Day=if(_time>=relative_time(now(),"@d"),"Today","Yesterday") | xyseries metric Day value | where Today>=2*Yesterday
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...