Taking from :https://answers.splunk.com/answers/185455/how-to-create-a-month-over-month-year-over-year-re.html and modifying it you could do something like:
index=zscaler urlsupercat="Advanced Security" earliest=-2month@month latest=-1month@month
| stats count as pre_month by urlcat
| join urlcat [ index=zscaler urlsupercat="Advanced Security" earliest=-1month@month latest=@month | stats count as this_month by urlcat ]
| eval month_perc=100*(this_month / pre_month)
| rename urlcat as "Threat Category"
| table month_perc,"Threat Category"
....
You could start by creating a base search that does the combined period (remember to keep _time and just the fields you need)
HTH ...Laurie:{)
... View more