Creating % Log Drop Alert?

[OiskyPoisky]

Hey There Folks,

Im looking at a way to measure a decrease in logging levels by host and eventcode. Ive setup the below query which is fine from a static perspective but very much looking to try and identify that scenario where lets say we see a 50% log drop off in a specific eventcode in the past 24 hour period.

index=wineventlog sourcetype=WinEventLog EventCode=4625
| fields EventCode, host
| stats dc(host) as num_unique_hosts
| where num_unique_hosts < 500

Is there an easy way to convert this over? 

Thanks Kindly,

Tom