Splunk Enterprise

Splunk Search time frame for alert

Path Finder


i have the following search:


index=_internal source=*license_usage.log* type="Usage" idx=example 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1h
| stats sum(b) as b by _time, host, pool, s, st, h, idx 
| search host=server1 
| timechart span=1h sum(b) AS volumeB by idx fixedrange=false
| eval date_wday=lower(strftime(_time,"%A")) |where NOT (date_wday="saturday" OR date_wday="sunday") | fields - date_wday
| eval tacp=round('example'/1024/1024/1024, 3)
| stats avg(example) as avg latest(example) as Event
| eval limit=(avg+((avg/100)*20))


All i want to do is...
The search should be run every hour and then it look back for the 30 Days for this special hour. Like:

Search starts at 12, every event at 12 for the last 30 days will be summarized and a avg will be made.
Then the avg gets plus 20%, this is my limit. After the limit is calculated the alert will look, if the limit is lower than the actual size for the actual day.
If not an E-Mail will be send.

Thank you for your comments.
Please help 🙂 

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...