calculations on events for daily alert

[punithjigali]

Hi team,

I need to create a alert, where if my daily count is less than 30 % of monthly count average... of a particular field

how is this..

[richgalloway]

This should get you started.

index=foo earliest=-30d 
| bucket span=1d _time 
| stats count by _time 
| stats avg(count) as MonthlyAvg, latest(count) as Today 
| eval limit=MonthlyAvg*0.30
| where Today < limit