Splunk Queries

Compare the count with last week(at that particular minute) results with now. If there is 10% difference then flush output

index=myindex sourcetype=mysourcetype  earliest=-7d@m-1m latest=-7d@m | timechart span=1d count | stats avg(count) as LastWeekVolume | appendcols 
[search index=myindex sourcetype=mysourcetyp earliest=@m-1m latest=now | stats count as Today] | where Today>=1.1*LastWeekVolume
 
index=myindex sourcetype=mysourcetype "{criteria-1}" | join request_id [search index=myindex sourcetype=mysourcetype "{criteria-2}"]  | rangemap field=http_response_code SUCCESS=200-299 BAD_REQUEST=400-402 UNAUTHORIZED=403-403 NOT-ELIGIBLE=404-408 CONFLICT=409-410 SERVER-ERROR=500-599  default=SYSTEM-FAILURE | stats count as entries by range

 

Leave a Reply

Your email address will not be published. Required fields are marked *