Splunk Search

Compare Current Field Value to 24 Hour Average

mcg_connor
Path Finder

So I am currently trying to compare the average value of a field is using 7 days of events to what the value is currently. If the current value is greater than 3 times that average I want it to send an alert. Currently I am able to do the first part that finds the average count of the field but I am unable to figure out how to compare that to the current field value.

index=db  sourcetype="dbmetrics" earliest=-7d
| stats avg(db_connections) as DBConnectionsAvg  by database

Sorry if the explanation on this is messy, pretty new to Splunk

0 Karma
1 Solution

mayurr98
Super Champion

Try this :

index=db sourcetype="dbmetrics" earliest=-7d 
| stats avg(db_connections) as DBConnectionsAvg latest(db_connections) as DBConnectionsCurrent by database 
| where 3*DBConnectionsAvg<DBConnectionsCurrent

View solution in original post

mayurr98
Super Champion

Try this :

index=db sourcetype="dbmetrics" earliest=-7d 
| stats avg(db_connections) as DBConnectionsAvg latest(db_connections) as DBConnectionsCurrent by database 
| where 3*DBConnectionsAvg<DBConnectionsCurrent

mcg_connor
Path Finder

Didn't know about the latest command. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...