Splunk Search

Do math on this period's numbers versus last period's

shulmaniel
New Member

I'd like to build an alert that essentially says "if the count from this hour is more than twice, or less than half, the count from the last hour, throw an alert." I'm new to Splunk, and I'm having a hard time figuring out how to write this. Obviously I've got the count part—using stats count or timechart count or whatever. That gives me a relatively compact table, with a double-digit number of rows. Now I essentially want to join that table to itself. If this were SQL, I would find it trivial; it'd be a quick self-join. I can't figure out how to encode it in Splunk. Is there an easy way to do this?

timewrap looked promising, but I couldn't figure out how to take just this hour's count and divide by just the last hour's count. Instead timewrap gave me a bunch of columns, including an hour ago but also many other hours ago.

Does this problem have an obvious answer?

Tags (2)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Check out relative_time or the date_hour field. Either will work

index=.. 
| timechart count 
| eval now=now()
| eval one_hour_ago=relative_time(now(), "-1h")
| eval compare_this_hour_to_last=if(_time>one_hour_ago AND _time<now, 'count',"") 
0 Karma

solarboyz1
Builder

Check out the following using extreme search to create a baseline and identify when performance doesn't match the baseline:

http://www.georgestarcher.com/splunk-getting-extreme-part-one/

0 Karma

shulmaniel
New Member

That feels like a sledgehammer to kill an ant. Am I misreading it?

Fundamentally, too, I don't think I'm doing an anomaly-detection task; I should be able to just do math using both this period and another period. No? In SQL, this would be trivial using basic arithmetic; it wouldn't require any extra machinery.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...