Splunk Search

## How to create an Alert for an increase in IIs requests compared to a previous date

Communicator

Hi,

I’m looking at creating Alert for an increase in IIs requests compared to a previous date based on a percentage.

just wondered if this was possible?

thanks,

joe

Labels (1)
• ### stats

1 Solution
SplunkTrust

At the very minimum, you can do something like

``````| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3``````

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

Tags (3)
SplunkTrust

At the very minimum, you can do something like

``````| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3``````

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

Tags (3)
Communicator

Thanks

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...