How to set up an alert if Value1 > 0, a second alert if Value2 > Value1 + 5, and a third alert if Value3 > Value1 + 10?

[manja054]

Data:
0:01:49 1
0:06:49 1
0:11:49 1
0:16:49 1
0:21:49 1
0:26:49 1
0:31:49 1
0:36:49 1

Logic to follow:
1) 1st alert when value in log is > 0 : host=* Sourcetype=* value1 > 0
2) 2nd alert when value in log increased by 5 from value in the 1st alert: host=* Sourcetype=* value2 > value1 + 5
3) 3rd alert when value exceeded original value +10: host=* Sourcetype=* value3 > value1 + 10
4) no alerts when value decreases: host=* Sourcetype=*

[Richfez · Accepted solution]

I think streamstats will work for what you need.

<search that generates the above results | 
streamstats window=2 last(value) as old_value first(value) as new_value | 
where new_value>old_value+5

You may need to flip the last/first values, or reverse the > sign, because my brain doesn't always remember those correctly.

Change the +5 in where new_value>old_value+5 for the different thresholds.

Once you have the list showing correctly for a particular test, create an alert for it. Repeat with different thresholds.