Splunk Enterprise Security

how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype

staparia
Explorer

| metadata type=sourcetypes index=* group by index

| search sourcetype=*
| where lastTime < (now() - 86400)

| eval Duration=tostring(now() - lastTime,"duration")

| search Duration="*"
| fields sourcetype lastTime Duration

| sort - lastTime

| eval lastTime = strftime(lastTime,"%Y/%m/%d %H:%M" )
| rex field=Duration "(?(\d+))+"

0 Karma

adonio
Ultra Champion

try something along those lines, search for the last 30 (or 31 days)

| tstats count as event_count where index=_internal by sourcetype _time span=24h
| eventstats avg(event_count) as days_avg by sourcetype
| eval delta = round(event_count - days_avg, 2)
| eval perc_change = round((event_count / days_avg) * 100, 2)
| where _time >= now() - 86400 
| eval alert = if(perc_change > 70 AND delta < 0,"ALERT","OK")

hope it helps

0 Karma

staparia
Explorer

I like the concept.. the only thing which is varying is Event Count is less than days average.

Instead Event count should be number of logs received over a time (example- time picker lets say 30 days)
and Days_avg should be average of event count of 30 days divided by 30 (eventcount/30)

percentage change should be number of events received in last 24 hours should a dip of more than 70 percent when compared with Days_avg

0 Karma

to4kawa
Ultra Champion
 | tstats count as event_count where index=_internal by sourcetype _time span=24h
 | eval day=strftime(_time,"%d")
 | eventstats dc(eval(strftime(_time,"%d"))) as days
 | eventstats sum(event_count) as days_total by sourcetype
 | eval  days_avg= round(days_total / days, 2)
 | eval perc_change = round((event_count / days_avg) * 100, 2)
 | eval delta = round(event_count - days_avg, 2)
 | where _time >= now() - 86400 
 | eval alert = if(perc_change > 70 AND delta < 0,"ALERT","OK")

Thanks @adonio
I modify the query for @adonio .

0 Karma

to4kawa
Ultra Champion

what's the average of logs?

0 Karma

staparia
Explorer

@to4kawa Overage count of logs(events) received over a specific time

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...