How to create an alert that runs every 3 hours to compare with the previous 24hr log volume?

[1RandomUser]

I'm new to Splunk and having a tough time getting this to work...Trying to create an alert if the current 24hr time range is 30% less than the previous 24hr time range 3hrs ago...Any help is appreciated!

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="aws:cloudwatch" earliest=-27h latest=-3h
| eval b=len(_raw)
| eval MB=b/1024/1024
| timechart span=24h count as MB
| timewrwap 1 series=short

[bowesmana · Accepted solution]

Using span 24h will make funny time alignment, but you want to calculate the last 27 hours worth and then create 2 calcs of totals, the first -27 to -3 hours, then -24 to 0 hours and compare the totals.

So calculate by 1 hour gaps and individually sum the ranges.

index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="*" earliest=-27h@h latest=@h
| eval b=len(_raw)
| eval MB=b/1024/1024
| bin _time span=1h aligntime=@h
| stats sum(MB) as MB by _time
| streamstats c
| stats sum(eval(if(c<=24, MB, null()))) as Prev_24 sum(eval(if(c>3, MB, null()))) as Current
| eval perc_diff=round((Prev_24-Current)/Prev_24*100,2)
| where perc_diff>30

 So perc_diff will be >30 if it's more than 30% less.

[1RandomUser]

This works. Never would've thought of using streamstats, thank you so much for the guidance!

[bowesmana]

Yeah - streamstats - just one way - others cou;d be

| eval c=1
| accum c

or could do a comparison of _time against relative_time(_time, "...") to work out which bracket, but that seems a little more complex.

streamstats is probably overkill, accum would do, but I'm used to using it. The simple if test following looks simple to understand

[1RandomUser]

thank you! i'm going to try accum as well :]