Need help on how to alert if daily count exceed 30 days average

[acesolar]

Hi all,

   Need some advice here. I have some logs that has the URL and the HTTP  response code.

   Sample here 

POST /abc/xyz 200
POST /abc/xyz 401
POST /abc/xyz 500

  Is there a way for me to do a search so that I can compare today count by response code, and alert if the count exceeds the 30 days average count of the response code?

Thanks

[acesolar]

Thank you. It worked like a charm

[ITWhisperer · Accepted solution]

Do a count by day for the last 30 days, then use eventstats to add a column with the average to every event, then reduce your events to just cover the day (or days) you are interested in, and compare the daily count to the average. Something like this

| bin span=1d _time
| stats count by _time response_code
| eventstats avg(count) as average by response_code
| where _time >= relative_time(now,"@d")
| where count>average