All Apps and Add-ons

How to get the average of the last 7 events to create an alert rule?

vtsguerrero
Contributor

Hello everybody,

How can I create a rule that controls a conditional table?
For example, there's a table with a specific css that shows a red icon, a green icon and an yellow icon over status based on the math distance ( number variation ) compared to the average.
So I would have, if the difference is
- 20% panel should show green.
- From 20% to %50 panel should show yellow
- Above 50% should show red.

So I have a conditional if, based on an average, this is my current search, but I have to keep in mind that these averages are based on last 14 events.

index=main sourcetype=full VALUE1=* VALUE2=* PROCESS_NAME=*
| eval TOTAL_VALUE = (VALUE1+VALUE2)
| eval AVERAGE = stats avg(TOTAL_VALUE )
| eval RULE = if(TOTAL_VALUE > AVERAGE , "HIGHER", if(TOTAL_VALUE < AVERAGE , "LOWER", "EQUAL"))
| table TOTAL_VALUE RULE

It should fit the app Splunk 6x Dashboard Examples (https://apps.splunk.com/app/1603/)
For a table with red, yellow and green icons.
Thanks in advance!

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...