How to get the average of the last 7 events to create an alert rule?

[vtsguerrero]

Hello everybody,

How can I create a rule that controls a conditional table?
For example, there's a table with a specific css that shows a red icon, a green icon and an yellow icon over status based on the math distance ( number variation ) compared to the average.
So I would have, if the difference is
- 20% panel should show green.
- From 20% to %50 panel should show yellow
- Above 50% should show red.

So I have a conditional if, based on an average, this is my current search, but I have to keep in mind that these averages are based on last 14 events.

index=main sourcetype=full VALUE1=* VALUE2=* PROCESS_NAME=*
| eval TOTAL_VALUE = (VALUE1+VALUE2)
| eval AVERAGE = stats avg(TOTAL_VALUE )
| eval RULE = if(TOTAL_VALUE > AVERAGE , "HIGHER", if(TOTAL_VALUE < AVERAGE , "LOWER", "EQUAL"))
| table TOTAL_VALUE RULE

It should fit the app Splunk 6x Dashboard Examples (https://apps.splunk.com/app/1603/)
For a table with red, yellow and green icons.
Thanks in advance!

[muebel · Accepted solution]

I think the streamstats command is what you want :

http://docs.splunk.com/Documentation/Splunk?title=Documentation:SearchReference:Streamstats:4.0beta&...