How to enable an anomaly detection whenever there is a change in value of a field?

[simon21]

I have a field called capacity. I want to enable anomaly detection whenever there is a change in value of capacity (increments or decrements). So, if capacity value for a source "A" is "10" at 7th dec 14:40pm, and at 7th Dec 15:15pm, the capacity of source "A" is "12", then i want to be notified via an alert. Please help. Thanks!

[sundareshr]

I believe what you need is anomalousvalue. Try this, set your alert to trigger if count>0

base search | anomalousvalue capacity action=filter