Dynamic baseline of IP hits

[N92]

I have total counts of unique IP hits. how can I create dynamic baseline for the hit counts with respect to IP addresses. Tried some average and standard deviation formulas but not getting expected output with search processing power optimization

[to4kawa]

Sample: Alert if 50% different from 1 hour ago.

| makeresults count=2
| streamstats count
| eval _time=if(count=1,relative_time(_time,"-20h@h"),relative_time(_time,"@h"))
| makecontinuous span=5m _time
| eval ip_count=random() % 2
| timechart span=1h sum(ip_count) as ip_count
| autoregress ip_count as prev_ip_count
| eval diff=max(ip_count,prev_ip_count) / min(ip_count,prev_ip_count)
| eval alert=nullif( diff > 2 ,NULL)

[to4kawa]

Is timechart span=1h dc(ip) wrong?

[N92]

Sorry for incomplete information. I am looking for trend kind of statistics. if last day I have this much of hits from single IP and today if suddenly it's increased than rule should trigger.