https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136936#M37476 <P>I’d like to compare 1) the number of events received in the last 30 minutes with 2) the average number of events received in the last 30 calendar days (reduced to a 30 minutes span)</P> <P>If the result of 1) exceeds by 50% the result of 2), I’d like to have something like “warning”, otherwise “normal”.</P> <P>I’ve come up with the following search but it doesn’t seem to be working and I cannot figure out what is wrong with it (I’m pretty sure it’s right under my nose)</P> <P>earliest=-30d@d index=index sourcetype=sourcetype | search host=host | stats count as last30days | eval average_reference=(last30days/30/1440*30) | appendcols [ search earliest=-30m latest=now index=index sourcetype=sourcetype | search host=host | stats count as last30minutes ] | eval status = if(last30minutes &gt;= 1.5*average_reference, "Warning", "Normal")</P> <P>Any help would be appreciated! </P> Mon, 28 Sep 2020 20:08:25 GMT cedmarjls32 2020-09-28T20:08:25Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136936#M37476 <P>I’d like to compare 1) the number of events received in the last 30 minutes with 2) the average number of events received in the last 30 calendar days (reduced to a 30 minutes span)</P> <P>If the result of 1) exceeds by 50% the result of 2), I’d like to have something like “warning”, otherwise “normal”.</P> <P>I’ve come up with the following search but it doesn’t seem to be working and I cannot figure out what is wrong with it (I’m pretty sure it’s right under my nose)</P> <P>earliest=-30d@d index=index sourcetype=sourcetype | search host=host | stats count as last30days | eval average_reference=(last30days/30/1440*30) | appendcols [ search earliest=-30m latest=now index=index sourcetype=sourcetype | search host=host | stats count as last30minutes ] | eval status = if(last30minutes &gt;= 1.5*average_reference, "Warning", "Normal")</P> <P>Any help would be appreciated! </P> Mon, 28 Sep 2020 20:08:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136936#M37476 cedmarjls32 2020-09-28T20:08:25Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136937#M37477 <P>You have too many <CODE>| search</CODE>; this works for me:</P> <PRE><CODE>earliest=-30d@d index=index sourcetype=sourcetype host=host | stats count as last30days | eval average_reference=(last30days/30/1440*30) | appendcols [ search earliest=-30m latest=now index=index sourcetype=sourcetype | stats count as last30minutes ] | eval status = if(last30minutes &gt;= (1.5*average_reference), "Warning", "Normal") </CODE></PRE> Fri, 05 Jun 2015 14:06:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136937#M37477 woodcock 2015-06-05T14:06:29Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136938#M37478 <P>Thanks for your feedback!</P> Fri, 05 Jun 2015 14:34:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-number-of-events-during-two-specific-time-periods/m-p/136938#M37478 cedmarjls32 2015-06-05T14:34:43Z