Alerting

How to edit my search to alert me on heavy frequency change on Netflow?

nickbijmoer
Path Finder

Hello guys,

I want to generate an alert when my netflow count is something like 10% above the usual average count.
I got something like this but i don't know how to go further 😞

sourcetype="cisco:asa"  earliest=-7d@d latest=@d   | stats count by date_mday  | eventstats avg(count)

can someone help me?

Greetings,

Nick

0 Karma

somesoni2
Revered Legend

Give this a try (assuming you want to compare today's count with last 7 day's average count. If not adjust the relative_time value in eval period ).

sourcetype="cisco:asa" earliest=-7d@d latest=now | timechart span=1d count | eval period=if(_time>=relative_time(now(),"@d"),"today","last7days") | eval temp=1
| stats avg(count) as avgcount over temp by period | fields - temp
| where today>1.1*last7days
0 Karma

nickbijmoer
Path Finder

I get the error: Error in 'stats' command: The argument 'over' is invalid.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...