Splunk Search

How to Change rate in percentage?

humi
Explorer

Hi all, i count the number of ssl-login-fail for each hour.

index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result

It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).

I tested lot of thing but i'm lost...

Thanks a lot.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

humi
Explorer

Thanks a lot @gcusello for your answer, it works fine!

would it be abused to ask it with a result by host?

I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?

A presto ! 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:

index... host... action="ssl-login-fail" 
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.

About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...