Splunk - subtract two counts and trigger alert

Question

I'm trying to find proper Splunk documentation about the following, but it seems pretty difficult. What I need to do is conceptually simple: I want to find out the number of certain events for two successive days and subtract them (simply subtract the numbers). For example, I need to find out the number of successful POST calls (HTTP 200) to a certain website ('somewebsite/myaction'), c1, that happened 2 days ago:

search sourcetype = myproject:prod somewebsite post myaction 200 
earliest=-2d@d latest=-1d@d | stats count as c1

Also, I do the same to find out the same type of events for yesterday, let's call it c2:

search sourcetype = myproject:prod somewebsite post myaction 200 
earliest=-1d@d latest=-0d@d | stats count as c2

Now all I need to do is find out c1 - c2 and trigger an event if this value is above a certain threshold. I'm trying something like this, but it doesn't show me 't':

| set diff [search sourcetype = myproject:prod somewebsite post 
myaction 200 earliest=-2d@d latest=-1d@d | stats count as c1] [search 
sourcetype = myproject:prod somewebsite post myaction 200 
earliest=-1d@d latest=-0d@d | stats count as c2] | eval t=(c1-c2)

Thanks,

Greetings,

Sorin

P.S.

I come very close with the following:

sourcetype=myproject:prod somewebsite post checkout 200 earliest=-2d@d latest=-1d@d 
| stats count as C1 | appendcols [search sourcetype = myproject:prod somewebsite 
post checkout 200 earliest=-1d@d latest=-0d@d | stats count as C2] | eval t=(C1 
- C2)

Now all I need to do is to express in an alert that I want it to be triggered when t is above a threshold (e.g. t > 100). How can I do that ?

score 0 · Answer 1 · answered Nov 28 '18 at 19:39

I understand how this works: the last piece of the puzzle was to add 'where t > 100':

sourcetype=myproject:prod somewebsite post checkout 200 earliest=-2d@d 
latest=-1d@d 
| stats count as C1 | appendcols [search sourcetype = myproject:prod 
somewebsite 
post checkout 200 earliest=-1d@d latest=-0d@d | stats count as C2] | eval t=(C1 
- C2) | where t > 100

Now, with this search I can simply create an alert triggered when the number of results is greater than 0 (if I have results, it means that in my formula t was greater that 100, so I need to trigger this as an alert). That's all ! Pity that specific Splunk documentation is so hard to find.

Splunk - subtract two counts and trigger alert

1 Answers1