Splunk Search

Consult the volume comparison of the last 07 days, above 80% of the value of the last days to alarm.

leandromatperei
Path Finder

I have the following query below, I need to generate a third column or generate an alarm when the values ​​generated are 80% higher than the last 07 days

earliest=-7d@d index=txt
| eval ELAPTIME = round(ELAPTIME / 100,2)/60
| timechart eval(round(avg(ELAPTIME),2)) as "Job Execution"

Result Splunk:

_timeJob Execution
2020-06-0955.00
2020-06-1051.74
2020-06-1155.74
2020-06-1270.00
2020-06-1390.00
2020-06-1485.00
2020-06-15150

 

Note that on June 15, the job had a problem because of his time that was 80% above the other days.

Labels (2)
0 Karma

DalJeanis
Legend

There are lots of ways.  Here is one.  

By the way, this is a comparison of the last 7 full  days to the current partial day.  The word "ALERT" will appear in a third column if the latest day is at least 80% higher than the prior average.

If you wanted to run this over a month or so, the code would look different.

earliest=-7d@d index=txt
| fields _time ELAPTIME
| bin _time span=1d 
| stats avg(ELAPTIME) as ELAPTIME by _time 
| eventstats max(_time) as maxtime
| eval ELAPTIME = round(ELAPTIME/6000,2)
| eval TODAYTIME=case(_time=maxtime,ELAPTIME)
| eventstats avg(eval(case(_time<maxtime,ELAPTIME))) as AVGTIME 
| eval ALERT=case(TODAYTIME>1.8*AVGTIME,"ALERT")
| table _time ELAPTIME ALERT
| rename ELAPTIME as "Job Execution"

 

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...