Can you help me with the following firewall alert trigger?

[CreieR]

I got the below search and I want to create an alert that would trigger:
1. when the total per day is bigger than X
2. When the total per day is two times bigger than the second value
3. when the average for a week is two times bigger for that user, or overall.

index="pan_logs" action=allow  
| stats  count sum(eval(bytes_received/1000000000)) as bytesReceivedGB  sum(eval(bytes_sent/1000000000)) as bytesSentGB sum(eval(bytes/1000000000)) as TotalGB  by user          
| sort  -TotalGB

Thank you !