Splunk Search

Detect Abnormal traffic on weekend

stehlampe69
Explorer

Hello,

we have several customers with astaro firewalls, and we want to detect abnormal traffic (for example in time-spaces where normally no traffic occurs, like on weekend).
The asg can use snmp to report the traffic to our splunk.
My idea was to get an average value for the last weeks and trigger an event if a value is over a specific limit or there is a value where no value should be (for example in case of weekend).

If there is an easy way to get this, it would be great. If not, I have to do it my way.

Thanks in advance
Peter

Tags (3)

chris
Motivator

There is a comercial app that can help:

http://www.prelert.com/products/anomaly-detective-for-splunk.html

You could experiment with the trendline command:

index=_internal earliest=-60m@m  | timechart span=10m count(host) as count | trendline sma7(count) | tail 1
0 Karma

stehlampe69
Explorer

Thanks a lot. I will try it.

Happy splunking!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...