How to do it...

Follow the steps in this recipe to create an alert when predicted sales exceed inventory:

  1. Log in to your Splunk server and select the Operational Intelligence application.
  2. Ensure that the time range picker is set to Last 60 Minutes, and type the following search in the Splunk search bar. Then, click on the magnifying glass icon or hit Enter:
index=main sourcetype=log4j earliest=-0d@d  requestType=removeItem OR requestType=updateCart OR  requestType=addItem  
[search index=main sourcetype=log4j requestType="checkout"  earliest=-0d@d | fields orderId]  
| eval quantity=if(requestType="removeItem",-1,quantity)  
| stats sum(quantity) AS quantity by itemId, date_hour  
| stats avg(quantity) as salesRate, sum(quantity) as Sales  by itemId ...

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial