Splunk Search

How to find spike in total count of a field?


I'd like to be able to search for the following:

1) timechart over X days for the sum of the count of a field
2) spikes or % increase for the sum of the count of a field compared to previous hour, day, week, etc

For example, we are ingesting Palo logs and I'd like to be able to see what fields have the highest sum/total for the time period I run and then also see the % increase/decrease of the sum/total for the field as well compared to an hour/day/week/etc.

Not looking to break the count of the field using 'BY', but just interested in the sum/total of all events for a field


0 Karma


Pipe the results of your query to "fieldsummary", which by default provides both "count" and "distinct_count".
I think this will get you the data you're after, based on your question.

See this documentation for more detailed explanation:

An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...