Splunk Search

Splunk query to check variation in processing time and volume in 5 minutes each (in last 10 minutes)

sahil237888
Path Finder

Hi, Can anyone help, As I want to get an alert if : The volume gets drop or if processing time gets increased of a specific server when being compared with last 5 minutes - The query should use volume and average response of current 5 minutes and last 5 minutes. and then if there is difference in volume < 50% or processing time > 60% then alert.

Labels (1)
0 Karma

scelikok
Champion

Hi @sahil237888,

Please try below sample;

index=your_index earliest=-15m 
| timechart span=5m partial=f avg(response_time) as response_time sum(volume) as volume
| autoregress response_time p=1
| autoregress volume p=1
| where response_time>response_time_p1*1.6 OR volume<volume_p1*0.5
If this reply helps you an upvote is appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!