Splunk Search

How do you send an alert when the number of records goes below 20% of the daily avg?

navd
New Member

Hi ,

I am using the below query to get an average count . But how do I write a query to send an alert when the number of records goes below 20% of the daily average?

index= abc platform=xyz | stats avg(count) by _time
Tags (2)
0 Karma

woodcock
Esteemed Legend
0 Karma

somesoni2
Revered Legend

Assuming you're running the alert daily to compare yesterday's (full day) count to check if it was less than daily average count over last 7 day (or 7 days prior to yesterday), try something like this (timerange selected to include data for past 8 days, excluding today):

index=abc platform=xyz earliest=-8d@d latest=@d | timechart span=1d count
| eval yesterday=if(_time=relative_time(now(),"-1d@d"), count, null())
| eval lastweek=if(_time<relative_time(now(),"-1d@d"), count, null())
| stats values(yesterday) as yesterday avg(lastweek) as dailyavg
| where yesterday<=0.8*dailyavg
0 Karma

navd
New Member

@somesoni2
I tried using the above query , but It don't see any results .

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...