how to create a threshold alert based on previous data?

[ahmar74]

I started off with the following search which gives me failed authentication to cisco acs on a daily basis, now i want to alert when a spike occurred on either day. For example, Monday received 100 failed logins and the following monday we received 1000 failed logins, i want to alert when that occurs but i am stumped, any suggestions.

| tstats summariesonly count values(Authentication.action) as Action from datamodel="Authentication" where (index=acs Authentication.action="failure") by _time span=1day
| convert timeformat="%A %d %B" ctime(_time)

[renjith_nair]

Hi @ahmar74,
Try this

|tstats summariesonly count values(Authentication.action) as Action from datamodel="Authentication" where (index=acs Authentication.action="failure") by _time span=1day
|eval week_day=strftime(_time,"%a")|sort week_day|streamstats current=f last(current) as prev by week_day
|eval diff=abs(current-prev)
|where diff > "your threshold value of spike"

[renjith_nair]

Hi @ahmar74,
Did this work for you?

[Ghanayem1974]

it looks good but having issues with the where diff, as i don't know a number to input.

[Ghanayem1974]

actually i keep getting error 'The search job has failed due to an error.'

[Ghanayem1974]

it did not like summariesonly so i removed it, but i can use some help on the where diff >, any ideas? thanks.

[renjith_nair]

Hi @Ghanayem1974, The value of threshold has to be decided by you based on your environment. You could think about a percentage also , for e.g. if the failures are more than 50% then alert e.t.c

[ghanayem74]

how would I write that?

[renjith_nair]

Try this run anywhere example

|tstats count as current where index=_internal by _time
 |eval week_day=strftime(_time,"%a")|sort week_day
 |streamstats current=f last(current) as prev by week_day|fillnull value="NA"
 |eval diff=if(prev=="NA",current,abs(current-prev))
 |eval perc_of_change=round((diff/prev)*100,2)|where perc_of_change > 20

[Sukisen1981]

If I am getting this correct - you have some data on failed logins on a daily basis, and your alert trigger is based on a day of the week comparison? In the example that you have given,if on the previous Monday you had 100 failed logins and on the following Monday you have 101 failed logins , an alert should be triggered?. Is it possible to attach a snapshot of the output that you are receiving in your statistics tab? May be a mock up?