Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow the steps in this recipe to create an alert that identifies abnormal response times:

1. Log in to your Splunk server and select the Operational Intelligence application.

2. Ensure that the time range picker is set to Last 60 Minutes and type the following search into the Splunk search bar. Then, click on the magnifying glass icon or hit Enter:

sourcetype=access_combined index=main | stats max(response)  AS MAX by uri_path | join uri_path [search earliest=-25h  latest=-24h sourcetype=access_combined index=main | stats  avg(response) AS AVG by uri_path] | eval MAG=round(MAX/AVG) 

This search relies on data being indexed on your Splunk server 25 hours ago. If this data is not present, you might need to adjust the subsearch's ...