topic Re: How do you send an alert when the number of records goes below 20% of the daily avg? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428637#M122623 <P>Check out this Q&amp;A!!!!!<BR /> <A href="https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html">https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html</A></P> Fri, 25 Jan 2019 19:05:55 GMT woodcock 2019-01-25T19:05:55Z How do you send an alert when the number of records goes below 20% of the daily avg? https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428634#M122620 <P>Hi ,</P> <P>I am using the below query to get an average count . But how do I write a query to send an alert when the number of records goes below 20% of the daily average?</P> <PRE><CODE>index= abc platform=xyz | stats avg(count) by _time </CODE></PRE> Fri, 25 Jan 2019 14:27:19 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428634#M122620 navd 2019-01-25T14:27:19Z Re: How do you send an alert when the number of records goes below 20% of the daily avg? https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428635#M122621 <P>Assuming you're running the alert daily to compare yesterday's (full day) count to check if it was less than daily average count over last 7 day (or 7 days prior to yesterday), try something like this (timerange selected to include data for past 8 days, excluding today):</P> <PRE><CODE>index=abc platform=xyz earliest=-8d@d latest=@d | timechart span=1d count | eval yesterday=if(_time=relative_time(now(),"-1d@d"), count, null()) | eval lastweek=if(_time&lt;relative_time(now(),"-1d@d"), count, null()) | stats values(yesterday) as yesterday avg(lastweek) as dailyavg | where yesterday&lt;=0.8*dailyavg </CODE></PRE> Fri, 25 Jan 2019 15:34:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428635#M122621 somesoni2 2019-01-25T15:34:24Z Re: How do you send an alert when the number of records goes below 20% of the daily avg? https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428636#M122622 <P>@somesoni2<BR /> I tried using the above query , but It don't see any results .</P> Fri, 25 Jan 2019 17:28:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428636#M122622 navd 2019-01-25T17:28:39Z Re: How do you send an alert when the number of records goes below 20% of the daily avg? https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428637#M122623 <P>Check out this Q&amp;A!!!!!<BR /> <A href="https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html">https://answers.splunk.com/answers/511894/how-to-use-the-timewrap-command-and-set-an-alert-f.html</A></P> Fri, 25 Jan 2019 19:05:55 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-send-an-alert-when-the-number-of-records-goes-below/m-p/428637#M122623 woodcock 2019-01-25T19:05:55Z