How to compare results of 2 periods?

[jdonic]

Hello, guys. I am struggling with my search in splunk and would appreciate any help.

Currently I have search that outputs the number of results for last hour and the hour before that.

index="xxx" sourcetype="xxx" environment="stage" earliest=-2h@h latest=-0h@h | bin _time span=1h
| stats count as mycount by _time

Now I would like to compare those two hours and create an alert only if the number of results from last hour is 100x smaller than from hour before that. Is that possible? How could I go about such conditional?

[richgalloway]

Try this.

index=xxx sourcetype=xxx environment="stage" earliest=-2h@h latest=-0h@h 
| bin _time span=1h
| stats count as mycount by _time
```Associate the mycount field from the previous event with the current event```
| streamstats window=2 first(mycount) as previous
| where mycount <= (previous / 100)