Splunk Search

Splunk query to check variation in processing time and volume in 5 minutes each (in last 10 minutes)

sahil237888
Path Finder

Hi, Can anyone help, As I want to get an alert if : The volume gets drop or if processing time gets increased of a specific server when being compared with last 5 minutes - The query should use volume and average response of current 5 minutes and last 5 minutes. and then if there is difference in volume < 50% or processing time > 60% then alert.

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @sahil237888,

Please try below sample;

index=your_index earliest=-15m 
| timechart span=5m partial=f avg(response_time) as response_time sum(volume) as volume
| autoregress response_time p=1
| autoregress volume p=1
| where response_time>response_time_p1*1.6 OR volume<volume_p1*0.5
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...