Hi Splunkers!
Good day!
I need a search which extracts the count of serial_number of different time range and i should calculate the difference, if its greater than 5000, it should trigger an alert,
index="inventory" origin="Inventory:ITSM" earliest=-6h latest=now()
| fields serial_number
| stats count(serial_number) as total_assets
| search [ search index="inventory" origin="Inventory:ITSM" earliest=-12h latest=-6h
| fields serial_number
| stats count(serial_number) as total_assets_prev]
| eval diff=total_assets_prev-total_assets
| where diff>5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, total_assets_prev, total_assets
This query is not working.
Thanks in advance!
Manoj Kumar S
Hi
You could use relative_time function to divide your events like this
index="inventory" origin="Inventory:ITSM" earliest=-12h latest=now()
| eval period = if (_time < relative_time(now(),"-6h"), "previous", "current")
| stats count(search_id) as total_si by period
| eval {period}=total_si
| fields current previous
| stats sum(*) as *
| eval diff = previous - current
| where diff > 5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, previous current
There are also other ways to do it.
r. Ismo
index="inventory" origin="Inventory:ITSM" earliest=-12h latest=now()
| fields serial_number
| stats count(eval(_time<relative_time(now(),"-6h"))) as total_assets_prev count(eval(_time>relative_time(now(),"-6h"))) as total_assets
| eval diff=total_assets_prev-total_assets
| where diff>5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, total_assets_prev, total_assets
Hi @ITWhisperer ,
Thanks for your response!
I'm getting total_assets_prev as 0,
(My requirement is calculate the count of serial_number of time range -12 hr to -6hr and count of serial_number for the time range -6hr to now and calculate the difference)
Thanks in advance!
Manoj Kumar S
Remove this line
| fields serial_number