"with condition" earliest="-8d@d" latest="@d"
| bin span=1d _time
| stats count by _time
| stats avg(count) as average
| fields average
| appendcols
[ search "with same condition" earliest="-12h@m"
| stats count
| fields count ]
| eval high=1.1*average
| eval alert=if(count > high, "1", "0")
Set time period of search to be at least the past 8 days
Can you explain why earliest="-12h@m" is used?
The overall query has to cover the previous 8 days to get your average daily count, the earliest="-12h@m" is used to restrict this part of the search to be your rolling 12 hours i.e. -12 hours snapped to the minute. If you want it snapped to the hour, then use earliest="-12h@h". This is what I assumed you meant by "last rolling 12 hours"
"with condition" earliest="-8d@d" latest="@d"
| bin span=1d _time
| stats count by _time
| stats avg(count) as average
| fields average
| appendcols
[ search "with same condition" earliest="-12h@m"
| stats count
| fields count ]
| eval high=1.1*average
| eval alert=if(count > high, "1", "0")
Set time period of search to be at least the past 8 days