Splunk Search

## How to create an Alert for an increase in IIs requests compared to a previous date

Communicator

Hi,

I’m looking at creating Alert for an increase in IIs requests compared to a previous date based on a percentage.

just wondered if this was possible?

thanks,

joe

Labels (1)
• ### stats

1 Solution
SplunkTrust

At the very minimum, you can do something like

``````| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3``````

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

Tags (3)
SplunkTrust

At the very minimum, you can do something like

``````| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3``````

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

Tags (3)
Communicator

Thanks

Get Updates on the Splunk Community!

#### Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

#### New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

#### Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...