How to create an alert for increase in traffic?



I am trying to create an alert where if there is a sudden traffic increase on the site with 404's it should get triggered. Instead of number I think writing an alert based on the percentage of traffic would be effective to avoid false positives.

For example, I have X number of traffic at 14:00 and Y number of traffic at 14:30 then we should have an alert at 15:00 if the percentage is very high let's say > 20%

index=test_env host=server-1* status=404

Any guidance is appreciated.

Labels (1)
0 Karma

Ultra Champion
index=test host=server-1* status=404
| timechart count span=30min by host
| untable _time host counts
| streamstats current=f last(counts) as prev by host
| eval diff = counts - prev
| eval perc = diff / counts * 100

please modify perc calculation.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...