https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525572#M148329 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227858">@Emily12</a>,</P><P>your request is just a little vague!</P><P>Anyway, try someting like this:</P><LI-CODE lang="markup">your_search earliest=-4h@h latest=now | stats min(variable) AS min max(variable) AS max | where NOT min=max</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 20 Oct 2020 14:14:01 GMT gcusello 2020-10-20T14:14:01Z https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525571#M148328 <P>Hi Everyone,</P><P>How can I write splunk search query to check if for particular variable value has increased in 4 hours.</P><P>Thanks in advance <span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:">😊</span></P> Tue, 20 Oct 2020 14:07:14 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525571#M148328 Emily12 2020-10-20T14:07:14Z https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525572#M148329 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227858">@Emily12</a>,</P><P>your request is just a little vague!</P><P>Anyway, try someting like this:</P><LI-CODE lang="markup">your_search earliest=-4h@h latest=now | stats min(variable) AS min max(variable) AS max | where NOT min=max</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 20 Oct 2020 14:14:01 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525572#M148329 gcusello 2020-10-20T14:14:01Z https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525591#M148337 <P class="lia-align-right"><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;Thank you so much.</P><P class="lia-align-right">This is what I was looking for.</P><P class="lia-align-right">&nbsp;</P><P class="lia-align-right">&nbsp;</P> Tue, 20 Oct 2020 15:11:16 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525591#M148337 Emily12 2020-10-20T15:11:16Z https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525592#M148338 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/227858">@Emily12</a>,</P><P>good for you.</P><P>Ciao and happy splunking.</P><P>Giuseppe</P><P>P.S. Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 20 Oct 2020 15:12:36 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search/m-p/525592#M148338 gcusello 2020-10-20T15:12:36Z