Splunk Enterprise Security

How to get the difference in count of users and then trigger an alert

shubham1234
New Member

Hi Everyone,
I have a splunk search:
Search:

sourcetype = onelogin:event index = onelogin earliest=-12d AND event_type_id=8 | stats count by app_name 

The above search will give the counts of people logged-In in every application which is in one login but I need to prepare a search that will see the count of people logged in today and the counts of people logged in before one week, and if the counts of logged in people are less than 50% then it will trigger a alert . PLEASE GUIDE ME

-> I need a search that will take the counts of people logged in today and before one week and calculate the difference and then i can make a alert on the basis of that difference.

0 Karma
1 Solution

sandeepmakkena
Contributor
index = onelogin sourcetype = onelogin:event earliest=@d latest=now
 | stats count as Today by app_name
 | appendcols [search index = onelogin sourcetype = onelogin:event earliest=-7d@d latest=@d
 | stats count as LastWeekSameDay by app_name]
 | eval perc=abs(round(((LastWeekSameDay-Today)/LastWeekSameDay)*100,2))

Let me know if you have any problems. Bye

View solution in original post

0 Karma

sandeepmakkena
Contributor
index = onelogin sourcetype = onelogin:event earliest=@d latest=now
 | stats count as Today by app_name
 | appendcols [search index = onelogin sourcetype = onelogin:event earliest=-7d@d latest=@d
 | stats count as LastWeekSameDay by app_name]
 | eval perc=abs(round(((LastWeekSameDay-Today)/LastWeekSameDay)*100,2))

Let me know if you have any problems. Bye

0 Karma

shubham1234
New Member

Thanks a lot 🙂

0 Karma

jacobpevans
Motivator

This is a nearly identical request to this question: https://answers.splunk.com/answers/774692/how-to-setup-alert-for-x-decrease-in-count-by-mark.html#an...

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...