Splunk Search

How to compare previous data and alert if result over 5 percencet

Builder

We have monthly data for each SBU and we want to setup an alert if any total increase more than 5% for up coming month.

index=mydata | bin span=1mon time | stats sum(total) as TotalVal by time, SBU | sort +SBU -time

Can you please help us to write a Splunk query to filter if any total increase more than 5% comparing with previous month.

Note: We have more than 50 SBU.

0 Karma
1 Solution

Builder

Streamstats works fine,

....| stats sum(total) as total by time, SBU | sort +SBU -time|table _time, SBU, total | streamstats current=f window=1 first(total) as prev by SBU |eval deltaval=total - prev | eval diffp=deltaval/total*100 | where diffp>5

View solution in original post

0 Karma

Builder

Streamstats works fine,

....| stats sum(total) as total by time, SBU | sort +SBU -time|table _time, SBU, total | streamstats current=f window=1 first(total) as prev by SBU |eval deltaval=total - prev | eval diffp=deltaval/total*100 | where diffp>5

View solution in original post

0 Karma

Champion

Any reason why streamstats , prev value is not woking?

SplunkTrust
SplunkTrust

That would be the way to go for this use case.

0 Karma

Builder

Thanks. Initially tried with delta. but streamstats works for this case.

0 Karma