Alert if number of dropped Packets is 3*baseline

[soesia12]

Hey!
I'm trying to create an alert that triggeres if the count of dropped/denied/blocked packets within one day is three times average count of dropped packets in the last 3 weeks.

The search for the packets dropped in the last 24 hours:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=1d | eventstats count(status) AS statcount BY _time | table statcount | dedup statcount

The search for the average packets dropped in the last 3 weeks per day:

sourcetype=syslog status=deny |where status="deny" OR status="blocked" OR status="dropped" |bucket _time span=3w | eventstats count(status) AS statcount BY _time | eval packs = statcount/21  | table packs | dedup packs

So my question is how can i trigger an alert if the result of the first search is 3 times higher than the result of the second search.

Thanks,
S.

[martin_mueller · Accepted solution]

You'll need to do both calculations in one go, something like this:

 sourcetype=syslog (status="deny" OR status="blocked" OR status="dropped") | timechart span=1d count

That gives you a daily count. Now you can get the average and bottom value by appending this:

... | stats avg(count) as avg last(count) as last

From that, you can do whatever maths and filtering you like with eval and where.

[martin_mueller]

Set the time range to the last three weeks.

[soesia12]

Hey! Thank you.

It seemed to work, but how do i specify that the average taken from the last 3 weeks?

[aaraneta_splunk]

@soesia12 - Did the answer provided by martin_mueller help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!