Splunk Enterprise Security

how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours

Engager

how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip/drop is more than 70% in last 24 hours

0 Karma

Ultra Champion

you should do three steps.
1. create base line csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| outputcsv your_csv.csv

with time picker, "last 30 days". earliest=-30d@d latest=@d
2. calculate the average and compare

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| join sourcetype [|inputlookup your_csv.csv
| stats sum(count) as Total by sourcetype]
| eval perc= round(count / Total * 100)

3 Create new csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| append [|inputcsv your_csv.csv]
| eventstats min(_time) as min_time
| where min_time!=_time
| outputcsv your_csv.csv

sample: slow query(time picker:last 30 days)

| tstats count prestats=t where index=main by _time span=1d sourcetype 
| timechart count by sourcetype 
| untable _time sourcetype count 
| eventstats sum(count) as Total by soucetype
| eval perc= round(count / Total * 100)
| reverse
| where strftime(_time,"%F")==strftime(now(),"%F")

Hi, @staparia
If you can be slow, use a query
Make a CSV if you do it every day

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!