How can I create a search for any host sending excessive logs in compare to last hour

[rahul_mckc_splu]

Please help me to create a search, where I need to detect any anomaly of any host sending excessive logs with compare to the last hour.

For eg, if a host is sending x events this hour and next hour if it will send x+25% then we should get a trigger.

[gcusello]

Hi @rahul_mckc_splunk1
as @to4kawa hints, try something like this:

index=your_index earliest=-2@h latest=@h
| timechart count span=1h
| delta count AS diff
| reverse
| head 1
| eval perc=diff/count*100
| where perc>25

and run this search every hour.

Ciao.
Giuseppe

[to4kawa]

bin _time , stats by _time and eval is useful to create threshold
finally, use where to fire alert.