extra large splunk login page background image

#EXTRA LARGE SPLUNK LOGIN PAGE BACKGROUND IMAGE SERIES#

This search uses a simple moving average for the last 5 results (sma5). | eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0) | trendline sma5(avg_bytes) as moving_avg_bytes Putting this all together, the search is: Changing the formatting of the y-axis to Log scale also helps. The 10000 here is arbitrary and you should choose a value relevant to your data that makes the spike noticeable.

The following search adds a field called 'spike' that indicates when the average number of bytes exceeds twice the moving average.

If you want to clearly identify spikes, you might add an additional series for spikes. To add another line or bar series to the chart for the simple moving average (sma) of the last 5 values of bytes, use this command: Sourcetype=access* | timechart avg(bytes) as avg_bytes Run a search followed by the trendline command using a field that you want to create a trendline for.įor example, on web access data, you could chart an average of the bytes field. You can use a moving trendline to help you see the spikes. Whatever type of spike you are interested in, you want to watch for it and then perhaps take some action to address those spikes. Traffic spikes, sales spikes, spikes in the number of returns, spikes in database load.

Spikes can show you where you have peaks (or troughs) that indicate that some metric is rising or falling sharply. You want to identify spikes in your data. There are a set of commands that you can use to perform anomaly detection.

#EXTRA LARGE SPLUNK LOGIN PAGE BACKGROUND IMAGE SERIES#

Extra large splunk login page background image