Splunk Search

How to Change rate in percentage?

humi
Explorer

Hi all, i count the number of ssl-login-fail for each hour.

index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result

It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).

I tested lot of thing but i'm lost...

Thanks a lot.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

humi
Explorer

Thanks a lot @gcusello for your answer, it works fine!

would it be abused to ask it with a result by host?

I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?

A presto ! 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:

index... host... action="ssl-login-fail" 
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.

About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...