How to create an alert for increase in traffic?



I am trying to create an alert where if there is a sudden traffic increase on the site with 404's it should get triggered. Instead of number I think writing an alert based on the percentage of traffic would be effective to avoid false positives.

For example, I have X number of traffic at 14:00 and Y number of traffic at 14:30 then we should have an alert at 15:00 if the percentage is very high let's say > 20%

index=test_env host=server-1* status=404

Any guidance is appreciated.

Labels (1)
0 Karma

Ultra Champion
index=test host=server-1* status=404
| timechart count span=30min by host
| untable _time host counts
| streamstats current=f last(counts) as prev by host
| eval diff = counts - prev
| eval perc = diff / counts * 100

please modify perc calculation.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...