Splunk Search

Need help top 2 division

duenguyen
Explorer

Hello I am a newbie on Splunk. I need to create an alert if #1 IP generated >2X of the #2 IP
and this is my search

sourcetype=csv | top sipAddress | head 2

sipAddress count
10.10.9.23 200
12.12.3.4 50

basically I will need to have first one divided by second if > 2 then I could put in my alert to send to customer.

Please help
Thanks

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try something like this :

sourcetype=csv | top limit=2 sipAddress |streamstats first(count) as count_B window=1 global=f current=f | tail 1 |eval count_ratio=count_B/count | table count_ratio

View solution in original post

Damien_Dallimor
Ultra Champion

Try something like this :

sourcetype=csv | top limit=2 sipAddress |streamstats first(count) as count_B window=1 global=f current=f | tail 1 |eval count_ratio=count_B/count | table count_ratio
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...