How can we detect and display fluctuations of data?

[danielbb]

We would like to detect and display fluctuations of data. So, let's say the count of network events for a certain sourcetype in this month is double than the previous month, we would like to show it in a panel and potentially create an alert for it.

How can we do it? 

[chirs]

It really depends on what you want, but this is what I do:

1. Build a search which gets run after midnight, so maybe 1 am, as a saved search to gather 30 days worth of data into statistics like max(), min(), avg() and so forth to get you the trend, broken out by day.
2. Then run a scheduled search at the cadence you want for the same data for today, comparing the values in the lookup table against the data you have for today.
3. Create an eval to give yourself a "this is about right", "this is too low", "this is too high" kind of status column.
4. Trigger an alert based on what conditions are not acceptable.