Splunk Enterprise Security

How to get diff between previous day vs current?

Ghanayem1974
Path Finder

the below search provides me info on failed logins for the past month, for example the last four fridays now i want to alert when a spike occurs for that day or any other day but i am lost at the where diff > any ideas?

|tstats count values(Authentication.action) as Action from datamodel="Authentication" where (index=something Authentication.action="failure") by _time span=1day
| eval week_day=strftime(_time,"%a")| sort week_day| streamstats current=f last(current) as prev by week_day
| eval diff=abs(current-prev)
| where diff > blahblah

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@Ghanayem1974 ,
Try similar to

|tstats count as current where index=_internal by _time
 |eval week_day=strftime(_time,"%a")|sort week_day
 |streamstats current=f last(current) as prev by week_day|fillnull value="NA"
 |eval diff=if(prev=="NA",current,abs(current-prev))
 |eval perc_of_change=round((diff/prev)*100,2)|where perc_of_change > 20
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!