How to make 2 windows to compare the values in these 2 windows

[jenniferhao]

We need to set up a dynamic thresholds to compare the values on current week with the week before, should generate alarm when the value out of the range of + - 5%. Do you have any idea to do this more effective?

for example:
index="abc" sourcetype="def" earliest=-12h latest=now
|bucket _time span=15m
stats max(x1) as x1 max(y1) as y1 by _time
[search
index="abc" sourcetype="def" earliest=-24h latest=-12h
|bucket _time span=15m
stats max(x2) as x2 max(y2) as y2 by _time
|eval alarm=if ((x1-x2)/x2 >=abs(0.5) OR (y1-y2)/y2>=abs(0.5),1,0)

[ITWhisperer]

Assuming you mean to append the second search, this doesn't work anyway since each event will have a different time so x1 and x2 (and y1 and y2) will exist in different events and therefore you can't do calculations on them. You need to arrange it so that the events from both searches have a common value so you can gather the stats into the same event. Also, the timeframes you have used don't bear any relation to the requirement of comparing this week to the previous week.