Can you help me fix my search which detects and alerts on campaign spikes from partners?

[arunsubram]

Hi,

The following is my query to list the API ingress flow of traffic from each of the partners. I would like to add an alert when there is a steep increase in traffic due to campaigns by looking at the last 1 week of average traffic by partner and alerting when the volume of call increases 2x the average to identify the partner.

index="access" "http_host=*.apir.test.com" |rename a as ApplicationId | lookup AppIdLookup ApplicationId OUTPUT PartnerName  | timechart usenull=f  span=1h count by PartnerName where top100 desc

I tried with the anomalydetection action=summary but it's not working. Any help here would be appreciated.

[MikeElliott]

Have you tried looking at the predict command? This is an ideal way to detect what you are looking for, but in a resource efficient and Splunk-friendly manner.

[woodcock]

Check out this amazing answer and links; you will get what you need here (be sure to UpVote😞
https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html