How do I get average and percentage change in the same query?

[spoolunk]

Below is the data in my index named index

ETS=20180921 CNT=161756 BRAND=A INDICATOR=Y
ETS=20180921 CNT=156203 BRAND=B INDICATOR=Y
ETS=20180921 CNT=12354 BRAND=C INDICATOR=Y
ETS=20180921 CNT=26267 BRAND=D INDICATOR=Y
ETS=20180921 CNT=1014571 BRAND=E INDICATOR=Y
ETS=20180921 CNT=2323 BRAND=F INDICATOR=Y
ETS=20180920 CNT=158563 BRAND=A INDICATOR=Y
ETS=20180920 CNT=156174 BRAND=B INDICATOR=Y
ETS=20180920 CNT=12332 BRAND=C INDICATOR=Y
ETS=20180920 CNT=26248 BRAND=D INDICATOR=Y
ETS=20180920 CNT=1013469 BRAND=E INDICATOR=Y
ETS=20180920 CNT=2321 BRAND=F INDICATOR=Y

where ETS is the date, cnt is the count, brands are A B C etc and and indicator.

I want to know how to get the percentage change in today's count by brand w.r.t. the average of 90 days. (Currently it has data for 2 days only) .

I am able to get the sum by brand, but not able to divide it by the days to get average .. also, I am not able to use that further to decrease from today's value.

please help.

[martin_mueller]

Assuming you have your timestamps extracted correctly, you can do something like this:

search your data over some time range
| bin span=1d _time
| stats sum(count) as count by _time BRAND
| stats sum(count) as total latest(count) as today by BRAND
| addinfo | eval days = round(info_max_time-info_min_time) | fields - info_*
| eval average = total / days | eval change = 100 * (1 - today/average)

First three rows get a daily sum for each brand.
Fourth row gets a total sum and the last day for each brand - note, if a brand didn't report "today" then it's using the most recent day. Whether that's correct or not depends on the specifics of your scenario.
Fifth row calculates the number of days in your time range.
Sixth row calculates daily averages and the percentage change for the last day.