Splunk Search

Compare Current Field Value to 24 Hour Average

Explorer

So I am currently trying to compare the average value of a field is using 7 days of events to what the value is currently. If the current value is greater than 3 times that average I want it to send an alert. Currently I am able to do the first part that finds the average count of the field but I am unable to figure out how to compare that to the current field value.

index=db  sourcetype="dbmetrics" earliest=-7d
| stats avg(db_connections) as DBConnectionsAvg  by database

Sorry if the explanation on this is messy, pretty new to Splunk

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this :

index=db sourcetype="dbmetrics" earliest=-7d 
| stats avg(db_connections) as DBConnectionsAvg latest(db_connections) as DBConnectionsCurrent by database 
| where 3*DBConnectionsAvg<DBConnectionsCurrent

View solution in original post

SplunkTrust
SplunkTrust

Try this :

index=db sourcetype="dbmetrics" earliest=-7d 
| stats avg(db_connections) as DBConnectionsAvg latest(db_connections) as DBConnectionsCurrent by database 
| where 3*DBConnectionsAvg<DBConnectionsCurrent

View solution in original post

Explorer

Didn't know about the latest command. Thanks!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!