All Apps and Add-ons

Is it possible to define 2 threshold based on time?

cbiraris
Path Finder

Hi Team,

I am trying to schedule a alert base on threshold for 2 time window.

100 events between 00:00 to 14:00 
20 events between   14:00 to 00:00 
 
is it possible to define 2 threshold like above ? in one alert

index=ABC sourcetype=XYZ failedlogin |stats count |where count >100   between 00:00 to 14:00 

index=ABC sourcetype=XYZ failedlogin |stats count |where count >20 between 14:00 to 00:00 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

please try this.

index=ABC sourcetype=XYZ failedlogin 
| stats count earliest(_time) AS _time
| eval time_hour=strftime(_time,"%H")
| eval threeshold=if(time_hour<15,100,20)
| where count>threeshold

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

please try this.

index=ABC sourcetype=XYZ failedlogin 
| stats count earliest(_time) AS _time
| eval time_hour=strftime(_time,"%H")
| eval threeshold=if(time_hour<15,100,20)
| where count>threeshold

Ciao.

Giuseppe

cbiraris
Path Finder

Thank you @gcusello 
Its working 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...