Hi all, i count the number of ssl-login-fail for each hour.
index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result
It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).
I tested lot of thing but i'm lost...
Thanks a lot.
Hi @humi,
at first, if you filter results in thwe main search, you don't need the eval in the count.
Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:
index... host... action="ssl-login-fail"
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50
Ciao.
Giuseppe
Hi @humi,
at first, if you filter results in thwe main search, you don't need the eval in the count.
Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:
index... host... action="ssl-login-fail"
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50
Ciao.
Giuseppe
Thanks a lot @gcusello for your answer, it works fine!
would it be abused to ask it with a result by host?
I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?
A presto ! 🙂
Hi @humi,
the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:
index... host... action="ssl-login-fail"
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50
this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.
About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.
Ciao.
Giuseppe