Splunk Search

How to detected a Deviation of 20% vs weekly average?

christianubeda
Path Finder

Hi team!

I need to do that:

Eventcode = 4624 and 4634 with Logon Type = 10. An event will be generated if an access volume above normal is detected. Deviation of 20% vs weekly average.

This is my search right now;

index=* index=* (EventCode=4624 OR EventCode=4634) eventtype=wineventlog_security
| stats values(host), values(EventCodeDescription), values(Changes), values(Account_Domain), values(action) by _time
| rename values(host) as Host, values(EventCodeDescription) as Description, values(Changes) as Changes, values(Account_Domain) as "Account Domain", values(action) as Action, _time as Date
| convert timeformat="%m/%d/%Y %H:%M:%S" ctime(Date)

But I dont know how to detected a Deviation of 20% vs weekly average. I mean, how can I do that?

Thank you a lot.

Tags (1)
0 Karma

woodcock
Esteemed Legend
0 Karma

DavidHourani
Super Champion

Hi @christianubeda,

You seem to be looking for something like this :

index="_audit" | timechart span=1h count as A | eventstats avg(A) as WeeklyAverage | tail 1 | eval Result=(A/WeeklyAverage)*100

From there tweak the span to compare per hour/day/week and use the result for your threshold condition.

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...