how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip/drop is more than 70% in last 24 hours
you should do three steps.
1. create base line csv
| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| outputcsv your_csv.csv
with time picker, "last 30 days". earliest=-30d@d latest=@d
2. calculate the average and compare
| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| join sourcetype [|inputlookup your_csv.csv
| stats sum(count) as Total by sourcetype]
| eval perc= round(count / Total * 100)
3 Create new csv
| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| append [|inputcsv your_csv.csv]
| eventstats min(_time) as min_time
| where min_time!=_time
| outputcsv your_csv.csv
sample: slow query(time picker:last 30 days)
| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| eventstats sum(count) as Total by soucetype
| eval perc= round(count / Total * 100)
| reverse
| where strftime(_time,"%F")==strftime(now(),"%F")
Hi, @staparia
If you can be slow, use a query
Make a CSV if you do it every day