Splunk Enterprise Security

calculations on events for daily alert


Hi team,

I need to create a alert, where if my daily count is less than 30 % of monthly count average... of a particular field

how is this..

Labels (1)
0 Karma


This should get you started.

index=foo earliest=-30d 
| bucket span=1d _time 
| stats count by _time 
| stats avg(count) as MonthlyAvg, latest(count) as Today 
| eval limit=MonthlyAvg*0.30
| where Today < limit
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!