Good afternoon,
I have this query to get global deviations in the number of connections.
index=cisco_asa sourcetype="cisco:asa" Cisco_ASA_action=allowed earliest=-1w
| timechart count span=1d
| where strftime(_time, "%A") == strftime(now(),"%A")
| timewrap w
| rename "* ago" as * | eval avg=Total/3.0 | rename latest_week as Today 1week_before as Lastday _time as Date | eval ChangePercent = (Today - Lastday) / 100 | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(Date) | where ChangePercent > 0.20
if I wanted to detect the deviation per server as I could do?
Thank you