compare two results of the same search for different ranges and generate alert

[soutyanson]

dears,
this is my basic search:

index=index1 source=source1 sessionID

I will like compare the results (count) of the basic search for some timestamps and generate an alert mail if .

for exemple:

index=index1 source=source1 sessionID earliest = -10m latest = now --> Result1
index=index1 source=source1 sessionID earliest = -5m latest = now --> Result2
If Result2< 0,75*Result1 --> generate mail containing Result1

thanks

[somesoni2]

Try something like this

index=index1 source=source1 sessionID earliest = -10m latest = now | eval Result2=if(_time>relative_time(now(),"-5m"),1,0) | eventstats count as Result1 sum(Result2) as Result2 | where Result2< 0.75*Result1