Splunk Search

How to check if a value in a metric continues to grow?


I have a metric from AWS for the number of messages visible in a SQS queue, which gets computed every 5 minutes. 

2023-08-02 11:50:00    13.3
2023-08-02 11:55:00    0.0
2023-08-02 12:00:00    33.8
2023-08-02 12:05:00    0.0

This means that there were 13 messages in the queue, and 5 minutes later they were gone (processed). Then there were 33, then they were gone (processed)

If messages do not get processed, I'd expect this number to continue to grow and not decrease. 

I need to set up an alert when that happens. Is there some way to alert when a value grows, say, over 5 rows? 

Or, is there a way to compare a value to itself at different points in time? 


Labels (2)
Tags (1)
0 Karma


Basically, comparisons are done between fields in the same "event" - for your use case, this means you have to arrange for values from other events to be available in your event.

There are a number of ways to do this, and it depends on what you are looking to compare.

For example, you could find the change between two consecutive events

| streamstats window=2 current=f latest(sqs) as previous_sqs
| eval sqs_delta=sqs - previous_sqs

Or you could evaluate this as an increase or not, then count how many times it increased over the last 5 events

| streamstats window=2 current=f latest(sqs) as previous_sqs
| eval increase = if (previous_sqs < sqs, 1, 0)
| streamstats window=5 sum(increase) as rolling_increase

Then you could set your alert based on the value of rolling_increase.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...