I appreciate all the help and guidance!
This appears to be working -
`my_alerts` earliest=-30d@d latest=now | eval Last7day=if(_time<relative_time(now(),"@d") AND _time>=relative_time(now(),"-7d@d"),1,0)
| eval Previous7day=if(_time<relative_time(now(),"-7d@d") AND _time>=relative_time(now(),"-14d@d"),1,0)
| eval Last30day=if(_time<relative_time(now(),"@d"),1,0) | bucket span=1h _time | stats sum(*day) as *day by _time
| eventstats sum(Last30day) as tLast30day count(eval(Last30day>0)) as cLast30day | eval Last30dayAvg=tLast30day/cLast30day
| table _time Last7day Previous7day Last30dayAvg | where _time>=relative_time(now(),"-14d@d")
| eval _time=if(_time<relative_time(now(),"-7d@d") AND _time>=relative_time(now(),"-14d@d"),_time+604800,_time) | stats max(*) as * by _time
... View more