Splunk Search

How can I create a search for any host sending excessive logs in compare to last hour

rahul_mckc_splu
Loves-to-Learn

Please help me to create a search, where I need to detect any anomaly of any host sending excessive logs with compare to the last hour.

For eg, if a host is sending x events this hour and next hour if it will send x+25% then we should get a trigger.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rahul_mckc_splunk1
as @to4kawa hints, try something like this:

index=your_index earliest=-2@h latest=@h
| timechart count span=1h
| delta count AS diff
| reverse
| head 1
| eval perc=diff/count*100
| where perc>25

and run this search every hour.

Ciao.
Giuseppe

0 Karma

to4kawa
Ultra Champion

bin _time , stats by _time and eval is useful to create threshold
finally, use where to fire alert.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...