I'm new to Splunk and having a tough time getting this to work...Trying to create an alert if the current 24hr time range is 30% less than the previous 24hr time range 3hrs ago...Any help is appreciated!
index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="aws:cloudwatch" earliest=-27h latest=-3h
| eval b=len(_raw)
| eval MB=b/1024/1024
| timechart span=24h count as MB
| timewrwap 1 series=short
... View more