Splunk Enterprise Security

How to get the difference in count of users and then trigger an alert

shubham1234
New Member

Hi Everyone,
I have a splunk search:
Search:

sourcetype = onelogin:event index = onelogin earliest=-12d AND event_type_id=8 | stats count by app_name 

The above search will give the counts of people logged-In in every application which is in one login but I need to prepare a search that will see the count of people logged in today and the counts of people logged in before one week, and if the counts of logged in people are less than 50% then it will trigger a alert . PLEASE GUIDE ME

-> I need a search that will take the counts of people logged in today and before one week and calculate the difference and then i can make a alert on the basis of that difference.

0 Karma
1 Solution

sandeepmakkena
Contributor
index = onelogin sourcetype = onelogin:event earliest=@d latest=now
 | stats count as Today by app_name
 | appendcols [search index = onelogin sourcetype = onelogin:event earliest=-7d@d latest=@d
 | stats count as LastWeekSameDay by app_name]
 | eval perc=abs(round(((LastWeekSameDay-Today)/LastWeekSameDay)*100,2))

Let me know if you have any problems. Bye

View solution in original post

0 Karma

sandeepmakkena
Contributor
index = onelogin sourcetype = onelogin:event earliest=@d latest=now
 | stats count as Today by app_name
 | appendcols [search index = onelogin sourcetype = onelogin:event earliest=-7d@d latest=@d
 | stats count as LastWeekSameDay by app_name]
 | eval perc=abs(round(((LastWeekSameDay-Today)/LastWeekSameDay)*100,2))

Let me know if you have any problems. Bye

0 Karma

shubham1234
New Member

Thanks a lot 🙂

0 Karma

jacobpevans
Motivator

This is a nearly identical request to this question: https://answers.splunk.com/answers/774692/how-to-setup-alert-for-x-decrease-in-count-by-mark.html#an...

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...