https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130358#M2052 <P>By using append you're getting two rows in your result, while eval will operate on each row individually. Put this before your eval:</P> <PRE><CODE>... | stats first(prevday) as prevday first(currday) as currday | ... </CODE></PRE> <P>That will collapse the two rows into one, letting eval see both columns properly.</P> Thu, 30 Jan 2014 00:39:17 GMT martin_mueller 2014-01-30T00:39:17Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130357#M2051 <P>I want to compare the results from latest 4 hrs today with the results from the same time yesterday and want to set an alert if today's result drops by 20 percent.</P> <P>My search string is:</P> <P>index="abcd" earliest=-28h latest=-24h | stats count as prevday | <BR /> append [ search index="abcd" earliest=-4h latest=now | stats count as currday] | eval diff = (abs(prevday - currday)/prevday)*100</P> <P>Using this search string I could store the results in respective variables prevday and currday.. But I could not successfully set an alert by mentioning the custom condition diff &gt; 20. Where am I doing a mistake? What do I need to specify in alert condition so that I will get an alert if diff &gt; 20 ?</P> Wed, 29 Jan 2014 23:39:55 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130357#M2051 ranjani 2014-01-29T23:39:55Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130358#M2052 <P>By using append you're getting two rows in your result, while eval will operate on each row individually. Put this before your eval:</P> <PRE><CODE>... | stats first(prevday) as prevday first(currday) as currday | ... </CODE></PRE> <P>That will collapse the two rows into one, letting eval see both columns properly.</P> Thu, 30 Jan 2014 00:39:17 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130358#M2052 martin_mueller 2014-01-30T00:39:17Z https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130359#M2053 <P>Oh cool. This really worked for me. Appreciate your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 30 Jan 2014 17:58:40 GMT https://community.splunk.com/t5/Alerting/Custom-alert-condition/m-p/130359#M2053 ranjani 2014-01-30T17:58:40Z