Splunk® Light (Legacy)

Search and Reporting Examples

Acrobat logo Download manual as PDF

On October 22, 2021, Splunk Light will reach its end of life. After this date, Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

Identify spikes in data and notify using Splunk Light

You want to identify spikes in your data. Spikes can show you where you have peaks (or troughs) the indicate that some metric is rising or falling sharply. Traffic spikes, sales spikes, spikes in the number of returns, spikes in database load. Whatever type of spike you are interested in, you want to watch for it, set up alerts to notify you, and then perhaps take some action to address those spikes.

Search for spikes in your data

Use a moving trendline to help you see the spikes. Run a search followed by the trendline command using a field you want to create a trendline for.

For example, on web access data, you could chart an average of the bytes field.

sourcetype=access* | timechart avg(bytes) as avg_bytes

To add another line or bar series to the chart for the simple moving average (sma) of the last 5 values of bytes, use this command:

... | trendline sma5(avg_bytes) as moving_avg_bytes

If you want to clearly identify spikes, you might add an additional series for spikes. This is when the current value is more than twice the moving average.

... | eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)

The 10000 here is arbitrary and you should choose a value relevant to your data that makes the spike noticeable. Changing the formatting of the y-axis to Log scale also helps.

Putting this all together, the search is:

sourcetype=access* | timechart avg(bytes) as avg_bytes | trendline sma5(avg_bytes) as moving_avg_bytes | eval spike=if(avg_bytes > 2 * moving_avg_bytes, 10000, 0)

This search uses a simple moving average for the last 5 results (sma5). Consider a different number of values, for example sma20.

The trendline command also supports the exponential moving average (ema) and the weighted moving average (wma).

Alternatively, you can bypass the charting altogether and replace the eval command with the where command to filter your results.

... | where avg_bytes > 2 * moving_avg_bytes

And by looking at the table view or as an alert, you will only see the times when the avg_bytes spiked.

Last modified on 11 August, 2016
Notify when server load reaches a threshold using Splunk Light
Create an alert to monitor CPU usage using Splunk Light

This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters