Alerting

How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted.

ngwodo
Path Finder

I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility"  Here it is:

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)

 

Labels (1)
Tags (1)
0 Karma

ngwodo
Path Finder

Thanks. That was part of the answer. The splunk query I was looking for is:

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)

0 Karma

burwell
SplunkTrust
SplunkTrust

How about something like this

 

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| eventstats avg(count)as avg  max(count) as max  min(count) as min
| where count = max

..  change stats -> eventstats and then do some kind of comparison

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...