Splunk Search

How to Change rate in percentage?

humi
Explorer

Hi all, i count the number of ssl-login-fail for each hour.

index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result

It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).

I tested lot of thing but i'm lost...

Thanks a lot.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

humi
Explorer

Thanks a lot @gcusello for your answer, it works fine!

would it be abused to ask it with a result by host?

I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?

A presto ! 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:

index... host... action="ssl-login-fail" 
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.

About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...