How to create an alert for increase in traffic?

[Shashank_87]

Hi,

I am trying to create an alert where if there is a sudden traffic increase on the site with 404's it should get triggered. Instead of number I think writing an alert based on the percentage of traffic would be effective to avoid false positives.

For example, I have X number of traffic at 14:00 and Y number of traffic at 14:30 then we should have an alert at 15:00 if the percentage is very high let's say > 20%

index=test_env host=server-1* status=404

Any guidance is appreciated.

[to4kawa]

index=test host=server-1* status=404
| timechart count span=30min by host
| untable _time host counts
| streamstats current=f last(counts) as prev by host
| eval diff = counts - prev
| eval perc = diff / counts * 100

please modify perc calculation.