index = _internal component=Metrics earliest=-60m@m latest=-30m@m | stats count as OldMetrics
| appendcols
[search index = _internal component=Metrics earliest=-30m@m latest=now | stats count as LatestMetrics]
| eval deviation=round(OldMetrics/LatestMetrics,2),deviation=1-deviation
| eval alert=case(deviation<-0.5,"Yes",deviation>-.05 AND deviation<0.5,"No",deviation>0.5,"Yes")
That should give you an example of how you can compare two values across two time periods. For your use case you'd want to format the single value to be red if deviation is between -0.5 and 0.5 (hence you can use the alert field) - if you need to use numeric values cause formatting doesn't let you use Yes/No, then use replace those in the search
... View more