I would like to compare the row count returned from two searches and trigger an alert based on whether search 1 returns more rows than search 2. Is there a way to do this?
Yes, a simple implementation would be like this. More accurate/optimized suggestions if you can share your searches.
search1 | stats count as count1| appendcols [search search2 | stats count as count2] | where count1>count2
@jbrenner - Were you able to test out somesoni2's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!