Searching issues in comparing data

[user290317]

Hi Splunker beginner here.

I'm having an issue in forming the search syntax for comparing the biggest amount of client logs deleted accidentally on a current day as opposed to the average of the previous month. I'm here at the moment source="deleted.xml" earliest=-d ACCIDENTAL_DELETES > ...

[somesoni2 · Accepted solution]

The pseudo search would be like this

source="deleted.xml" earliest=@d ACCIDENTAL_DELETES > ...
| stats count by client_indentifier_field
| where count>[search source="deleted.xml" earliest=-1mon@m latest=@mon ACCIDENTAL_DELETES > ..   | query to calculate last month's average | table average | rename average  as query]

[user290317]

With some additional play around with the syntax I managed to solve it. Thanks.

[user290317]

To be more specific I'm searching for all the amounts of accidental deletes on the current day that supersedes the avg for the previous month.