Creating an alert based off of an anomalous value in search result

[noch1999]

Hello Splunk

I am trying to set an alert when a result is much higher than the other rows.

A simplified search of:

index="my index" user=* | top limit=200 

returns a row of users which usually has a high count of 150-200, but during some events this will obviously differ so I can't just use a static value. Is there a way I can do something like:

when (count.row1 > 5xcount.row2) {trigger alert} 

Thank you in advance.

[ITWhisperer]

If you are only interested in the ratio of the first to the second, you could do something like this

index="my index" user=* | top limit=2 | eventstats sum(count) as total | head 1 | eval ratio=count/(total - count)