Compare values of main search and subsearch

[parker_ryan]

I am looking to compare the count of transactions processed in a 3 hour window to the count of transactions made in that same timeframe 3 days prior. I would like to set the count of the first search as variable such as count1 and likewise for the second search as count2. Then I could do a comparison to alert when the difference in transactions is outside 20% 
(where Count1 <= Count2*0.8 OR Count1 >=Count2*1.2) 

My search currently looks like this (It is not functional, so I would love to know how to fix it):

index=sales messageType=AuthPaymentReply earliest=-246h latest=-243h
| dedup OrderId
| search Status="Success"
| stats count by Status as Count1
| search [search index=sales messageType=AuthPaymentReply earliest=3h latest=now
| dedup OrderId
| search Status="Success"
| stats count by Status as Count2]
| where Count1 <= Count2*0.8 OR Count1 >=Count2*1.2

[parker_ryan]

@manjunathmeti That worked! Thank you so much! 

[manjunathmeti · Accepted solution]

hi @parker_ryan ,

Try this query. 

Subsearch returns count for the last 3 hours and main search returns count for the same timeframe 3 days prior.

index=sales messageType=AuthPaymentReply earliest=-3d@-3h latest=-3d Status="Success"
| dedup OrderId
| stats count as Count1 
| appendcols 
[ search index=sales messageType=AuthPaymentReply earliest=-3h latest=now Status="Success"
| dedup OrderId
| stats count as Count2]
| where Count1 <= Count2*0.8 OR Count1 >=Count2*1.2

If this reply helps you, an upvote/like would be appreciated.