How to create splunk rule query to determine when volatility changes from low to high and to be able to be alerted.

[ngwodo]

I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility"  Here it is:

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)

[ngwodo]

Thanks. That was part of the answer. The splunk query I was looking for is:

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| stats avg(count) max(count) min(count)

[burwell]

How about something like this

index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon
| timechart span=1day count
| timechart span=1month earliest(count) AS count
| eventstats avg(count)as avg  max(count) as max  min(count) as min
| where count = max

..  change stats -> eventstats and then do some kind of comparison