Splunk Search

How to Change rate in percentage?

humi
Explorer

Hi all, i count the number of ssl-login-fail for each hour.

index... host... action="ssl-login-fail" | timechart span=1h count(eval(action="ssl-login-fail")) as result

It's interesting but i would like to have change's rate in order to make alert if this rate change too much (>50% maybe).

I tested lot of thing but i'm lost...

Thanks a lot.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

at first, if you filter results in thwe main search, you don't need the eval in the count.

Then you can use the "delta" command (https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Delta) to calculate deltadiff between a value and the previous one:

index... host... action="ssl-login-fail" 
| timechart span=1h count
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

Ciao.

Giuseppe

humi
Explorer

Thanks a lot @gcusello for your answer, it works fine!

would it be abused to ask it with a result by host?

I searched for it to improve my dashboard and it seems to have to use STREAMSTATS function.
What is your opinion on this?

A presto ! 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

the problem by host is that you don't have one column to use for the delta, so it's more complicated and should be tested using a similar approach:

index... host... action="ssl-login-fail" 
| timechart span=1h count BY host
| sort host _time
| delta count AS countdiff
| eval perc=countdiff/count*100
| where perc>50

this solution has the issue of the delta between the last value of an host and the first of the following one that I cannot test, you should start from my search and find a rule to exclude this border values.

About streamstats, it's a useful command but I don't think that could be useful in this case and it isn't more performant than timechart, but I could be wrong.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...