Splunk Search

Alerting on a threshold

SecureIA
Path Finder

Hi all,

I currently have a very simple search that looks at the distinct visitors for a website per day. See below,

sourcetype=iis | stats dc(cs_username)

Is there a way of converting this search to an alert which will trigger when there is an abnormally high amount of visitors?

Any help would be massively appreciated.

0 Karma

twinspop
Influencer

If you want something dynamic, you could use timechart + delta + stream stats. Something along these lines:

sourcetype=iis earliest=-6m@m latest=@m|
  timechart span=1m dc(cs_username) as DU |
  delta DU as Delta |
  streamstats window=5 current=f global=t avg(Delta) as AvgLast5Delta |
  eval PercentageChange=100*round((AvgLast5Delta-Delta)/AvgLast5Delta,4) |
  tail 1

Alert on (absolute?) PercentageChange being bigger than some number.

EDIT: Made PercentageChange an actual percentage

0 Karma

DMohn
Motivator

You can always select the "Save as" option (right top, above the time range picker) and save the search as an alert.

If you want the alert to trigger as soon as the dc(cs_username) exceeds a certain number, change the Alert type to Real-time, and set the needed trigger conditions.

Then you can add an alert action to this alert (could be email, script, ...)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...