https://community.splunk.com/t5/Splunk-Dev/How-do-I-compare-count-over-two-time-periods/m-p/347945#M5489 <P>The exact code depends entirely on what you mean by -1 std dev of change in 15 minutes. Here are a couple of examples.</P> <P>This will look across the last 2 hours and find any minute where the average count for the prior 15 minutes is 1 s.d. below the average across the prior 2 hours.</P> <PRE><CODE>earliest=-2h index=* app=clamav | bin _time span=1m | stats count as mycount by _time | streamstats avg(mycount) as avgcount15, stdev(mycount) as stdevcount15 time_window=15m | streamstats avg(mycount) as avgcount120, stdev(mycount) as stdevcount120 time_window=2h | where avgcount15 &lt; avgcount120 - stdevcount120 </CODE></PRE> <P>This code will find any 15-minute period (2:00-2:15, 2:15-2:30, etc) where the average for the period is 1 s.d. below the average across the prior 2 hours.</P> <PRE><CODE>earliest=-2h index=* app=clamav | bin _time span=1m | stats count as mycount by _time | eventstats avg(mycount) as avgcount120, stdev(mycount) as stdevcount120 | bin _time span=15m | stats avg(mycount) as mycount15, first(avgcount120) as avgcount120, first(stdevcount120) as stdevcount120 by _time | where avgcount15 &lt; avgcount120 - stdevcount120 </CODE></PRE> Wed, 08 Mar 2017 22:35:48 GMT DalJeanis 2017-03-08T22:35:48Z https://community.splunk.com/t5/Splunk-Dev/How-do-I-compare-count-over-two-time-periods/m-p/347944#M5488 <P>All, </P> <P>Thought there was a one stop shop command for this, but I can't find it. Basically I just want an alert when I see a drop in count of events. Say I have 1stddev of change in 15 minutes? </P> <PRE><CODE>index=* app=clamav | stats count </CODE></PRE> Tue, 07 Mar 2017 23:10:06 GMT https://community.splunk.com/t5/Splunk-Dev/How-do-I-compare-count-over-two-time-periods/m-p/347944#M5488 daniel333 2017-03-07T23:10:06Z https://community.splunk.com/t5/Splunk-Dev/How-do-I-compare-count-over-two-time-periods/m-p/347945#M5489 <P>The exact code depends entirely on what you mean by -1 std dev of change in 15 minutes. Here are a couple of examples.</P> <P>This will look across the last 2 hours and find any minute where the average count for the prior 15 minutes is 1 s.d. below the average across the prior 2 hours.</P> <PRE><CODE>earliest=-2h index=* app=clamav | bin _time span=1m | stats count as mycount by _time | streamstats avg(mycount) as avgcount15, stdev(mycount) as stdevcount15 time_window=15m | streamstats avg(mycount) as avgcount120, stdev(mycount) as stdevcount120 time_window=2h | where avgcount15 &lt; avgcount120 - stdevcount120 </CODE></PRE> <P>This code will find any 15-minute period (2:00-2:15, 2:15-2:30, etc) where the average for the period is 1 s.d. below the average across the prior 2 hours.</P> <PRE><CODE>earliest=-2h index=* app=clamav | bin _time span=1m | stats count as mycount by _time | eventstats avg(mycount) as avgcount120, stdev(mycount) as stdevcount120 | bin _time span=15m | stats avg(mycount) as mycount15, first(avgcount120) as avgcount120, first(stdevcount120) as stdevcount120 by _time | where avgcount15 &lt; avgcount120 - stdevcount120 </CODE></PRE> Wed, 08 Mar 2017 22:35:48 GMT https://community.splunk.com/t5/Splunk-Dev/How-do-I-compare-count-over-two-time-periods/m-p/347945#M5489 DalJeanis 2017-03-08T22:35:48Z