Splunk Enterprise Security

how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours

staparia
Explorer

how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip/drop is more than 70% in last 24 hours

0 Karma

to4kawa
Ultra Champion

you should do three steps.
1. create base line csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| outputcsv your_csv.csv

with time picker, "last 30 days". earliest=-30d@d latest=@d
2. calculate the average and compare

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| join sourcetype [|inputlookup your_csv.csv
| stats sum(count) as Total by sourcetype]
| eval perc= round(count / Total * 100)

3 Create new csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| append [|inputcsv your_csv.csv]
| eventstats min(_time) as min_time
| where min_time!=_time
| outputcsv your_csv.csv

sample: slow query(time picker:last 30 days)

| tstats count prestats=t where index=main by _time span=1d sourcetype 
| timechart count by sourcetype 
| untable _time sourcetype count 
| eventstats sum(count) as Total by soucetype
| eval perc= round(count / Total * 100)
| reverse
| where strftime(_time,"%F")==strftime(now(),"%F")

Hi, @staparia
If you can be slow, use a query
Make a CSV if you do it every day

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...