Splunk Search

Detect Abnormal traffic on weekend

Explorer

Hello,

we have several customers with astaro firewalls, and we want to detect abnormal traffic (for example in time-spaces where normally no traffic occurs, like on weekend).
The asg can use snmp to report the traffic to our splunk.
My idea was to get an average value for the last weeks and trigger an event if a value is over a specific limit or there is a value where no value should be (for example in case of weekend).

If there is an easy way to get this, it would be great. If not, I have to do it my way.

Thanks in advance
Peter

Tags (3)

Motivator

There is a comercial app that can help:

http://www.prelert.com/products/anomaly-detective-for-splunk.html

You could experiment with the trendline command:

index=_internal earliest=-60m@m  | timechart span=10m count(host) as count | trendline sma7(count) | tail 1
0 Karma

Explorer

Thanks a lot. I will try it.

Happy splunking!

0 Karma