https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272937#M5000 <P>use the where class to find your matching records, something like this, </P> <PRE><CODE>|stats count, avg(concurrent_user) as user_count by date_minute, date_second |trendline sma10(user_count) as user_count_moving_average | where user_count_moving_average &lt;=count </CODE></PRE> <P>in the saved search schedule it when more than one events presents. </P> <P>Hope this will helps you. </P> Wed, 01 Feb 2017 18:43:29 GMT vasanthmss 2017-02-01T18:43:29Z https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272936#M4999 <P>I am trying to monitor a log and alert when a certain value spikes higher than usual. <BR /> trendline seems to be useful here.</P> <P>Something like </P> <PRE><CODE>|stats count, avg(concurrent_user) as user_count by date_minute, date_second |trendline sma10(user_count) as user_count_moving_average </CODE></PRE> <P>can provide both single value in user_count and a moving average. </P> <P>How can I set up an alert that can compare the two values, so that if the single value is much greater than the moving average?<BR /> I can calculate moving average of different periods and make the comparison as well. I get the search right, but the custom condition on alert setup is baffling me.</P> Wed, 01 Feb 2017 17:34:28 GMT https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272936#M4999 jaewankim 2017-02-01T17:34:28Z https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272937#M5000 <P>use the where class to find your matching records, something like this, </P> <PRE><CODE>|stats count, avg(concurrent_user) as user_count by date_minute, date_second |trendline sma10(user_count) as user_count_moving_average | where user_count_moving_average &lt;=count </CODE></PRE> <P>in the saved search schedule it when more than one events presents. </P> <P>Hope this will helps you. </P> Wed, 01 Feb 2017 18:43:29 GMT https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272937#M5000 vasanthmss 2017-02-01T18:43:29Z https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272938#M5001 <P>I know it's been a long time since you answered, but your answer helped me at least, well done!</P> Fri, 13 Dec 2019 08:32:42 GMT https://community.splunk.com/t5/Alerting/How-to-alert-on-comparison-of-two-fields-in-a-single-search/m-p/272938#M5001 adrien_dereumau 2019-12-13T08:32:42Z