Index alert excessive growth

[Emiskowi]

We are having problem with some of our indexes growing rapidly. I am trying to figure out a search/alert that have a deviation by the hour compared to previous days at the same time. I have the following search below that gives me the usage by the hour. Any help would be greatly appreciated.

index=_internal group="per_index_thruput" earliest = -1h@h latest=@h
| eval mb=kb/1024
| timechart span=1h sum(mb) as HourlyTotal
| addtotals fieldname=HourlyTotal
| streamstats sum(HourlyTotal) AS AccumulatedTOTAL
| bucket _time span=1d

[valiquet]

You can use standard deviation
| stats stdevp(HourlyTotal) as standdev by series | head 1 | where Hourly> HourlyTotal*2