Splunk Search

Consult the volume comparison of the last 07 days, above 80% of the value of the last days to alarm.

leandromatperei
Path Finder

I have the following query below, I need to generate a third column or generate an alarm when the values ​​generated are 80% higher than the last 07 days

earliest=-7d@d index=txt
| eval ELAPTIME = round(ELAPTIME / 100,2)/60
| timechart eval(round(avg(ELAPTIME),2)) as "Job Execution"

Result Splunk:

_timeJob Execution
2020-06-0955.00
2020-06-1051.74
2020-06-1155.74
2020-06-1270.00
2020-06-1390.00
2020-06-1485.00
2020-06-15150

 

Note that on June 15, the job had a problem because of his time that was 80% above the other days.

Labels (2)
0 Karma

DalJeanis
Legend

There are lots of ways.  Here is one.  

By the way, this is a comparison of the last 7 full  days to the current partial day.  The word "ALERT" will appear in a third column if the latest day is at least 80% higher than the prior average.

If you wanted to run this over a month or so, the code would look different.

earliest=-7d@d index=txt
| fields _time ELAPTIME
| bin _time span=1d 
| stats avg(ELAPTIME) as ELAPTIME by _time 
| eventstats max(_time) as maxtime
| eval ELAPTIME = round(ELAPTIME/6000,2)
| eval TODAYTIME=case(_time=maxtime,ELAPTIME)
| eventstats avg(eval(case(_time<maxtime,ELAPTIME))) as AVGTIME 
| eval ALERT=case(TODAYTIME>1.8*AVGTIME,"ALERT")
| table _time ELAPTIME ALERT
| rename ELAPTIME as "Job Execution"

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...