Count events for two period of time

[Haleb]

I need to calculate the average number of events in the last hour and compare it with the number of events in the last 10 minutes for each host.
index="cloudflare"
| spath path=ClientRequestHost output=host
| stats count as event_count by host
| eval avg_count_of_events = round(event_count/6)
| map search="search index=cloudflare ClientRequestHost=$host$ earliest=-10min | stats count as last_count_of_events | eval host=$host$ | eval avg_count_of_events=$avg_count_of_events$ | eval event_count=$event_count$ "
| eval percent_of_increase = round((last_count_of_events/avg_count_of_events)*100)-100
| table host avg_count_of_events last_count_of_events percent_of_increase

Is the more effective way to do that?

[ITWhisperer · Accepted solution]

map is slow and limited - try something like this

| timechart span=10m aligntime=latest count by host
| addcoltotals label="Total" labelfield=_time
| tail 2
| eval _time=if(_time=="Total", _time, "last_count_of_events")
| fields - _span
| transpose 0 column_name=host header_field=_time
| eval avg_count_of_events=round(Total/6)
| eval percent_of_increase = round((last_count_of_events/avg_count_of_events)*100)-100
| table host avg_count_of_events last_count_of_events percent_of_increase