https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-diff-between-previous-day-vs-current/m-p/403295#M4626 <P>the below search provides me info on failed logins for the past month, for example the last four fridays now i want to alert when a spike occurs for that day or any other day but i am lost at the where diff &gt; any ideas?</P> <P>|tstats count values(Authentication.action) as Action from datamodel="Authentication" where (index=something Authentication.action="failure") by _time span=1day<BR /> | eval week_day=strftime(_time,"%a")| sort week_day| streamstats current=f last(current) as prev by week_day<BR /> | eval diff=abs(current-prev)<BR /> | where diff &gt; blahblah</P> Tue, 29 Sep 2020 20:09:02 GMT Ghanayem1974 2020-09-29T20:09:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-diff-between-previous-day-vs-current/m-p/403295#M4626 <P>the below search provides me info on failed logins for the past month, for example the last four fridays now i want to alert when a spike occurs for that day or any other day but i am lost at the where diff &gt; any ideas?</P> <P>|tstats count values(Authentication.action) as Action from datamodel="Authentication" where (index=something Authentication.action="failure") by _time span=1day<BR /> | eval week_day=strftime(_time,"%a")| sort week_day| streamstats current=f last(current) as prev by week_day<BR /> | eval diff=abs(current-prev)<BR /> | where diff &gt; blahblah</P> Tue, 29 Sep 2020 20:09:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-diff-between-previous-day-vs-current/m-p/403295#M4626 Ghanayem1974 2020-09-29T20:09:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-diff-between-previous-day-vs-current/m-p/403296#M4627 <P>@Ghanayem1974 ,<BR /> Try similar to</P> <PRE><CODE>|tstats count as current where index=_internal by _time |eval week_day=strftime(_time,"%a")|sort week_day |streamstats current=f last(current) as prev by week_day|fillnull value="NA" |eval diff=if(prev=="NA",current,abs(current-prev)) |eval perc_of_change=round((diff/prev)*100,2)|where perc_of_change &gt; 20 </CODE></PRE> Tue, 26 Jun 2018 07:53:37 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-get-diff-between-previous-day-vs-current/m-p/403296#M4627 renjith_nair 2018-06-26T07:53:37Z