Splunk Search

How to create an Alert for an increase in IIs requests compared to a previous date

joe06031990
Communicator

Hi,

I’m looking at creating Alert for an increase in IIs requests compared to a previous date based on a percentage.

just wondered if this was possible?

 

thanks,

 

joe

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

At the very minimum, you can do something like

| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

View solution in original post

Tags (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

At the very minimum, you can do something like

| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

Tags (3)
0 Karma

joe06031990
Communicator

Thanks 

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...