Splunk Enterprise

How to make 2 windows to compare the values in these 2 windows


We need to set up a dynamic thresholds to compare the values on current week with the week before, should generate alarm when the value out of the range of + - 5%. Do you have any idea to do this more effective?

for example:
index="abc" sourcetype="def" earliest=-12h latest=now
|bucket _time span=15m
stats max(x1) as x1 max(y1) as y1 by _time
index="abc" sourcetype="def" earliest=-24h latest=-12h
|bucket _time span=15m
stats max(x2) as x2 max(y2) as y2 by _time
|eval alarm=if ((x1-x2)/x2 >=abs(0.5) OR (y1-y2)/y2>=abs(0.5),1,0)

Labels (1)
Tags (1)
0 Karma


Assuming you mean to append the second search, this doesn't work anyway since each event will have a different time so x1 and x2 (and y1 and y2) will exist in different events and therefore you can't do calculations on them. You need to arrange it so that the events from both searches have a common value so you can gather the stats into the same event. Also, the timeframes you have used don't bear any relation to the requirement of comparing this week to the previous week.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...