i need your help in creating a search that would count number of values for a field in a month and then compare it to a 3months average of the same results.
only one question,: do you want to calculate the count for the current month or the last 30 days or the previous month?
because if the current month you have an incomplete count, I suppose that you want the last complete month count compared with the three months before count.
so please try this:
index=your_index earliest=-mon@mon latest=@mon
| stats count AS "Current month"
| append [ search
index=your_index earliest=-4mon@mon latest=-3mon@mon
| stats count AS "Three months ago" ]
| table "Current month" "Three months ago"
| eval Diff="Three months ago"-"Current month"