how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours

[staparia]

how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip/drop is more than 70% in last 24 hours

[to4kawa]

you should do three steps.
1. create base line csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| outputcsv your_csv.csv

with time picker, "last 30 days". earliest=-30d@d latest=@d
2. calculate the average and compare

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| join sourcetype [|inputlookup your_csv.csv
| stats sum(count) as Total by sourcetype]
| eval perc= round(count / Total * 100)

3 Create new csv

| tstats count prestats=t where index=main by _time span=1d sourcetype
| timechart count by sourcetype
| untable _time sourcetype count
| append [|inputcsv your_csv.csv]
| eventstats min(_time) as min_time
| where min_time!=_time
| outputcsv your_csv.csv

sample: slow query(time picker:last 30 days)

| tstats count prestats=t where index=main by _time span=1d sourcetype 
| timechart count by sourcetype 
| untable _time sourcetype count 
| eventstats sum(count) as Total by soucetype
| eval perc= round(count / Total * 100)
| reverse
| where strftime(_time,"%F")==strftime(now(),"%F")

Hi, @staparia
If you can be slow, use a query
Make a CSV if you do it every day