I think part of your problem is that you are losing the reference to the "combination" field by doing your first timechart. You could try something like the following: (Note: I have not tested this as I do not have access to your data) eventtype=cacti:mirage host="onl-cacti-02" host_id=193 ldi IN("8835","8836","8837","8839","8840","8841","8846","8847","8848","8843","8844",)
| reverse
| eval combination=rrdn+"#"+name_cache
| streamstats current=t window=2 global=f range(_time) as deltaTime range(rrdv) AS rrd_value_delta by combination
| eval isTraffic = if(like(rrdn,"%traffic%"),1,0)
| eval kpi = if(isTraffic==1,rrd_value_delta*8/deltaTime,rrd_value_delta/deltaTime)
| bucket _time span=5m
| stats last(kpi) as last_kpi by combination _time
| sort combination _time
| streamstats current=t window=2 range(last_kpi) as last_kpi_diff by combination
| eval change_percent=(last_kpi/(last_kpi-last_kpi_diff))*100
| where change_percent>30 AND last_kpi_diff!=0
... View more