Splunk Enterprise Security

how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype

staparia
Explorer

| metadata type=sourcetypes index=* group by index

| search sourcetype=*
| where lastTime < (now() - 86400)

| eval Duration=tostring(now() - lastTime,"duration")

| search Duration="*"
| fields sourcetype lastTime Duration

| sort - lastTime

| eval lastTime = strftime(lastTime,"%Y/%m/%d %H:%M" )
| rex field=Duration "(?(\d+))+"

0 Karma

adonio
Ultra Champion

try something along those lines, search for the last 30 (or 31 days)

| tstats count as event_count where index=_internal by sourcetype _time span=24h
| eventstats avg(event_count) as days_avg by sourcetype
| eval delta = round(event_count - days_avg, 2)
| eval perc_change = round((event_count / days_avg) * 100, 2)
| where _time >= now() - 86400 
| eval alert = if(perc_change > 70 AND delta < 0,"ALERT","OK")

hope it helps

0 Karma

staparia
Explorer

I like the concept.. the only thing which is varying is Event Count is less than days average.

Instead Event count should be number of logs received over a time (example- time picker lets say 30 days)
and Days_avg should be average of event count of 30 days divided by 30 (eventcount/30)

percentage change should be number of events received in last 24 hours should a dip of more than 70 percent when compared with Days_avg

0 Karma

to4kawa
Ultra Champion
 | tstats count as event_count where index=_internal by sourcetype _time span=24h
 | eval day=strftime(_time,"%d")
 | eventstats dc(eval(strftime(_time,"%d"))) as days
 | eventstats sum(event_count) as days_total by sourcetype
 | eval  days_avg= round(days_total / days, 2)
 | eval perc_change = round((event_count / days_avg) * 100, 2)
 | eval delta = round(event_count - days_avg, 2)
 | where _time >= now() - 86400 
 | eval alert = if(perc_change > 70 AND delta < 0,"ALERT","OK")

Thanks @adonio
I modify the query for @adonio .

0 Karma

to4kawa
Ultra Champion

what's the average of logs?

0 Karma

staparia
Explorer

@to4kawa Overage count of logs(events) received over a specific time

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...