It really depends on what you want, but this is what I do:   Build a search which gets run after midnight, so maybe 1 am, as a saved search to gather 30 days worth of data into statistics like max(), min(), avg() and so forth to get you the trend, broken out by day. Then run a scheduled search at the cadence you want for the same data for today, comparing the values in the lookup table against the data you have for today. Create an eval to give yourself a "this is about right", "this is too low", "this is too high" kind of status column. Trigger an alert based on what conditions are not acceptable. ... View more