How to Change rate in percentage?

[humi]

Hi all, i count the number of ssl-login-fail for each hour.

index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result

It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).

I tested lot of thing but i'm lost...

Thanks a lot.

[gcusello · Accepted solution]

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

[humi]

Thanks a lot @gcusello for your answer, it works fine!

would it be abused to ask it with a result by host?

I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?

A presto ! 🙂

[gcusello]

Hi @humi,

the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:

index... host... action="ssl-login-fail" 
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.

About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.

Ciao.

Giuseppe