I'm new to Splunk and having a tough time getting this to work...Trying to create an alert if the current 24hr time range is 30% less than the previous 24hr time range 3hrs ago...Any help is appreciated!
index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="aws:cloudwatch" earliest=-27h latest=-3h
| eval b=len(_raw)
| eval MB=b/1024/1024
| timechart span=24h count as MB
| timewrwap 1 series=short
Using span 24h will make funny time alignment, but you want to calculate the last 27 hours worth and then create 2 calcs of totals, the first -27 to -3 hours, then -24 to 0 hours and compare the totals.
So calculate by 1 hour gaps and individually sum the ranges.
index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="*" earliest=-27h@h latest=@h
| eval b=len(_raw)
| eval MB=b/1024/1024
| bin _time span=1h aligntime=@h
| stats sum(MB) as MB by _time
| streamstats c
| stats sum(eval(if(c<=24, MB, null()))) as Prev_24 sum(eval(if(c>3, MB, null()))) as Current
| eval perc_diff=round((Prev_24-Current)/Prev_24*100,2)
| where perc_diff>30
So perc_diff will be >30 if it's more than 30% less.
Using span 24h will make funny time alignment, but you want to calculate the last 27 hours worth and then create 2 calcs of totals, the first -27 to -3 hours, then -24 to 0 hours and compare the totals.
So calculate by 1 hour gaps and individually sum the ranges.
index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="*" earliest=-27h@h latest=@h
| eval b=len(_raw)
| eval MB=b/1024/1024
| bin _time span=1h aligntime=@h
| stats sum(MB) as MB by _time
| streamstats c
| stats sum(eval(if(c<=24, MB, null()))) as Prev_24 sum(eval(if(c>3, MB, null()))) as Current
| eval perc_diff=round((Prev_24-Current)/Prev_24*100,2)
| where perc_diff>30
So perc_diff will be >30 if it's more than 30% less.
This works. Never would've thought of using streamstats, thank you so much for the guidance!
Yeah - streamstats - just one way - others cou;d be
| eval c=1
| accum c
or could do a comparison of _time against relative_time(_time, "...") to work out which bracket, but that seems a little more complex.
streamstats is probably overkill, accum would do, but I'm used to using it. The simple if test following looks simple to understand
thank you! i'm going to try accum as well :]