How to get the difference in count of users and then trigger an alert

[shubham1234]

Hi Everyone,
I have a splunk search:
Search:

sourcetype = onelogin:event index = onelogin earliest=-12d AND event_type_id=8 | stats count by app_name 

The above search will give the counts of people logged-In in every application which is in one login but I need to prepare a search that will see the count of people logged in today and the counts of people logged in before one week, and if the counts of logged in people are less than 50% then it will trigger a alert . PLEASE GUIDE ME

-> I need a search that will take the counts of people logged in today and before one week and calculate the difference and then i can make a alert on the basis of that difference.

[sandeepmakkena · Accepted solution]

index = onelogin sourcetype = onelogin:event earliest=@d latest=now
 | stats count as Today by app_name
 | appendcols [search index = onelogin sourcetype = onelogin:event earliest=-7d@d latest=@d
 | stats count as LastWeekSameDay by app_name]
 | eval perc=abs(round(((LastWeekSameDay-Today)/LastWeekSameDay)*100,2))

Let me know if you have any problems. Bye

[shubham1234]

Thanks a lot 🙂

[jacobpevans]

This is a nearly identical request to this question: https://answers.splunk.com/answers/774692/how-to-setup-alert-for-x-decrease-in-count-by-mark.html#an...