Splunk Search

Splunk query to identify an anomaly for increase in frequency of errors in logs

VS0909
Communicator

Need help with Splunk query to identify an anomaly for increase in frequency of errors in logs. Historic data to compare with old errors frequency ,  can be of past one week.

Labels (5)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Please be more specific. What is your definition of "anomaly"? What kind of logs are you looking at?
---
If this reply helps you, Karma would be appreciated.

VS0909
Communicator

Thanks for the reply.

I am looking to trigger an alert in splunk if the frequency of an error (log_level=error) increases in server logs  as compared to its threshold  value. I have index for logs index=Serverlogs1.

Threshold value should be calculated dynamically based on past one week server logs.

Please help.

0 Karma

thambisetty
Super Champion

check below video, it uses machine learning to detect numerical outliers and also video describes how to use standard deviation ( with out machine learning) this may help you.

 

https://conf.splunk.com/files/2019/recordings/FN1390.mp4

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...