Splunk Search

How to create timechart for event spikes by comparing to the previous 10 minute?

ygzamx
Engager

Hi all!

I'm trying to create a Timechart showing only the graph bars where the number of events is 2X the number of events from the previous 10 minutes. 

 

E.g. if I have 10,000 events at 10:10 AM to 10:20 AM

and 30,000 at 10:20 AM -10:30 AM

then 35,000 at 10:30 AM to 10:40 AM

 

I want the timechart to show only the bar for 10:20-10:30 period, which is where the surge happened.

 

Hope that makes sense, thanks in advance!

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this (runanywhere sample, adjust per your query)

index = _internal sourcetype=splunk_web_access 
| timechart span=10m count
|  delta count as countdiff 
|  eval surge=(countdiff)/if(count-countdiff=0,1,count-countdiff) 
|  where surge>2

 

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this (runanywhere sample, adjust per your query)

index = _internal sourcetype=splunk_web_access 
| timechart span=10m count
|  delta count as countdiff 
|  eval surge=(countdiff)/if(count-countdiff=0,1,count-countdiff) 
|  where surge>2

 

0 Karma

ygzamx
Engager

Thank you! it works!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...