Splunk query to check variation in processing time and volume in 5 minutes each (in last 10 minutes)

[sahil237888]

Hi, Can anyone help, As I want to get an alert if : The volume gets drop or if processing time gets increased of a specific server when being compared with last 5 minutes - The query should use volume and average response of current 5 minutes and last 5 minutes. and then if there is difference in volume < 50% or processing time > 60% then alert.

[scelikok]

Hi @sahil237888,

Please try below sample;

index=your_index earliest=-15m 
| timechart span=5m partial=f avg(response_time) as response_time sum(volume) as volume
| autoregress response_time p=1
| autoregress volume p=1
| where response_time>response_time_p1*1.6 OR volume<volume_p1*0.5