https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370006#M108976 <P>We have monthly data for each SBU and we want to setup an alert if any total increase more than 5% for up coming month.</P> <P>index=mydata | bin span=1mon _time | stats sum(total) as Total_Val by _time, SBU | sort +SBU -_time</P> <P>Can you please help us to write a Splunk query to filter if any total increase more than 5% comparing with previous month.</P> <P>Note: We have more than 50 SBU.</P> Tue, 29 Sep 2020 16:03:23 GMT dhavamanis 2020-09-29T16:03:23Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370006#M108976 <P>We have monthly data for each SBU and we want to setup an alert if any total increase more than 5% for up coming month.</P> <P>index=mydata | bin span=1mon _time | stats sum(total) as Total_Val by _time, SBU | sort +SBU -_time</P> <P>Can you please help us to write a Splunk query to filter if any total increase more than 5% comparing with previous month.</P> <P>Note: We have more than 50 SBU.</P> Tue, 29 Sep 2020 16:03:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370006#M108976 dhavamanis 2020-09-29T16:03:23Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370007#M108977 <P>Any reason why streamstats , prev value is not woking?</P> Fri, 29 Sep 2017 17:34:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370007#M108977 Sukisen1981 2017-09-29T17:34:41Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370008#M108978 <P>That would be the way to go for this use case.</P> Fri, 29 Sep 2017 17:38:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370008#M108978 somesoni2 2017-09-29T17:38:03Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370009#M108979 <P>Thanks. Initially tried with delta. but streamstats works for this case.</P> Fri, 29 Sep 2017 17:57:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370009#M108979 dhavamanis 2017-09-29T17:57:46Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370010#M108980 <P>Streamstats works fine,</P> <P>....| stats sum(total) as total by _time, SBU | sort +SBU -_time|table _time, SBU, total | streamstats current=f window=1 first(total) as prev by SBU |eval deltaval=total - prev | eval diffp=deltaval/total*100 | where diffp&gt;5</P> Tue, 29 Sep 2020 16:03:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-previous-data-and-alert-if-result-over-5/m-p/370010#M108980 dhavamanis 2020-09-29T16:03:29Z