Detect Abnormal traffic on weekend

[stehlampe69]

Hello,

we have several customers with astaro firewalls, and we want to detect abnormal traffic (for example in time-spaces where normally no traffic occurs, like on weekend).
The asg can use snmp to report the traffic to our splunk.
My idea was to get an average value for the last weeks and trigger an event if a value is over a specific limit or there is a value where no value should be (for example in case of weekend).

If there is an easy way to get this, it would be great. If not, I have to do it my way.

Thanks in advance
Peter

[chris]

There is a comercial app that can help:

http://www.prelert.com/products/anomaly-detective-for-splunk.html

You could experiment with the trendline command:

index=_internal earliest=-60m@m  | timechart span=10m count(host) as count | trendline sma7(count) | tail 1

[stehlampe69]

Thanks a lot. I will try it.

Happy splunking!