Splunk Search

How to detect change in regular pattern

chanduira
Explorer

Hi Experts,

We want to detect change in data pattern. Example I have server with Power consumption is 2 KW, if there is change is Power consumption may be like +5% or -5% how to detect automatically send alerts are or generate report.

Is there any command or apps to detect change in data pattern.

Tags (1)
0 Karma

sundareshr
Legend

You could also look at autoregress command. Something like this might work

... | reverse | autoregress powerconsumption  as prev_value | eval change=prev_value/powerconsumption | where change<0.05 OR change>0.05

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Autoregress

0 Karma

tormodbp
Path Finder

Have you tried the anomalies command? It allows you to set a threshold value to indicate if an event, or field, is considered unexpected or anormal.

... | anomalies threshold=0.05 field=powerconsumption 

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Anomalies


In your alert you can specify a custom trigger condition. If you are using anomalies then the added field unexpectedness would present you the calculated "unexpectedness" and filtering out events inside the threshold, thus leaving you with only the unexpected events. You can then create a custom trigger condition that triggers an alarm if the fields value is above your threshold. The anomalies command should filter out any event within your threshold so choosing to trigger whenever the search gets a hit is also an option.

Here are some links to the Alerting Manual:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/AlertTriggerConditions
http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Definescheduledalerts#Advanced_conditional_a...

Cheers,

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...