I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility" Here it is:
index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)
Thanks. That was part of the answer. The splunk query I was looking for is:
index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)
How about something like this
index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| eventstats avg(count)as avg max(count) as max min(count) as min
| where count = max
.. change stats -> eventstats and then do some kind of comparison