Splunk Enterprise

How to create an alert on traffic drop Deviation?

shashank_24
Path Finder

Hi, I want to create an alert on traffic drop deviation. Something like if the traffic drop by 50% than what was it in last hour or if the traffic drops to zero, then I want the alert triggered.

Creating alert on 0 traffic is easy but that could give false positives as well so I am trying to find a way to alert only if there is a significant deviation.

Is that possible? I have this query at the moment which looks into the incoming requests. I can run the alert every 15 or 30 minutes and want to trigger if there is a deviation.

 

index=myapp_prod  "message.logPoint"=INCOMING_REQUEST | timechart span=30m count

 

Best Regards,
Shashank

Labels (1)
0 Karma

shashank_24
Path Finder

@ITWhisperer This was perfect. Everything I needed. Thanks for the help. 🙂

Just one more thing, Is there a way to compare that with same time frame but from last week? For example 10:00 today Thursday with 10:00 Thursday last week?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is a timewrap command for this sort of thing.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=myapp_prod  "message.logPoint"=INCOMING_REQUEST 
| timechart span=30m count
| streamstats window=1 current=f values(count) as previous
| where count / previous < 0.5
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...