https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207704#M60540 <P>How to alert based off the last reported number in a time chart. I want to alert based on a comparison of the last two numbers where if it that value grew more than x%, I want it to alert. </P> Mon, 01 Aug 2016 13:28:50 GMT sbattista09 2016-08-01T13:28:50Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207704#M60540 <P>How to alert based off the last reported number in a time chart. I want to alert based on a comparison of the last two numbers where if it that value grew more than x%, I want it to alert. </P> Mon, 01 Aug 2016 13:28:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207704#M60540 sbattista09 2016-08-01T13:28:50Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207705#M60541 <P>Could you provide more information on your current outputs and expected output? (The title says stats and the question says timechart ) Also share you current queries.</P> Mon, 01 Aug 2016 13:42:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207705#M60541 somesoni2 2016-08-01T13:42:34Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207706#M60542 <P>add this:</P> <PRE><CODE> | tail 2 | reverse | autoregress count | eval pct_increase=100 * (count - count_p1)/count | where pct_increase &gt; X </CODE></PRE> Mon, 01 Aug 2016 13:50:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207706#M60542 woodcock 2016-08-01T13:50:49Z https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207707#M60543 <P>so this is great however the pct_increase (i renamed it to pct_diff) is not putting a decimal so for instance<BR /> count count_p1 pct_diff <BR /> 18.32 10.25 807<BR /> pct_diff should be 8.07</P> <P>i fixed it by adding a decimal <BR /> | eval pct_increase=1.00 * (count - count_p1)/count | where pct_increase &gt; X</P> <P>thanks again i will be suing this a lot!</P> Tue, 29 Sep 2020 10:35:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-alert-based-off-the-last-reported-number-in-a-stats-count/m-p/207707#M60543 sbattista09 2020-09-29T10:35:49Z