how can I get a deviation from a specific IP?

[christianubeda]

Good afternoon,

I have this query to get global deviations in the number of connections.

index=cisco_asa sourcetype="cisco:asa" Cisco_ASA_action=allowed earliest=-1w
| timechart count span=1d
| where strftime(_time, "%A") == strftime(now(),"%A")
| timewrap w
| rename "* ago" as * | eval avg=Total/3.0 | rename latest_week as Today 1week_before as Lastday _time as Date | eval ChangePercent = (Today - Lastday) / 100 | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(Date) | where ChangePercent > 0.20

if I wanted to detect the deviation per server as I could do?

Thank you