Need help to update "Notable -Substantial Increase In Port Activity" to establish a base line for each destination port

[kamal_jagga]

We have not been using the Splunk ES for long and the “xswhere” used for this notable is an extreme search. The extreme search provides a non-fixed threshold on when to alert, but it needs time to first baseline. During this time, this correlation rule may be very active in creating notables, as it has yet to establish a base line for each destination port.
Current Search:

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag from datamodel=Network_Traffic.All_Traffic where nodename=All_Traffic.Traffic_By_Source.LAN_Traffic by All_Traffic.dest_port
| drop_dm_object_name("All_Traffic")
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

I tried to remove some of the ips of the known devices to reduce the count by updating the query.

| tstats allow_old_summaries=true count,values(All_Traffic.tag) as tag, values(All_Traffic.src_ip) as src_ip from datamodel=Network_Traffic.All_Traffic where nodename=All_Traffic.Traffic_By_Source.LAN_Traffic by All_Traffic.dest_port
| lookup test_exclude.csv ip as src_ip outputnew ip as ip
| where src_ip!=ip
| drop_dm_object_name("All_Traffic")
| xswhere count from count_by_dest_port_1d in network_traffic by dest_port is extreme

And also I know we can check the current threshold level for this using extreme search but I am unable to do that. And update the query in some way.

But I am not sure about it.

Kindly advise.

[gf13579]

And also I know we can check the current threshold level for this using extreme search

| inputlookup network_traffic.context.csv 
| table class,concept,center,count,domainMax,domainMin,points,size,type

Add this to look at a given port:

| search class=9571 

Check the 3 pipe-separated values in points, per concept, e.g.:

extreme    5|10|15

[jcoates]

Hi, this has a backing context generation search that you should review: Network - Port Activity By Destination Port - Context Gen.

I also recommend getting the Extreme Search Visualization app, which has tools for visually reviewing contexts and more documentation. https://splunkbase.splunk.com/app/2855/