Yes, I want to get two tables, the first table will contain the average values for the last 12 hours and have two columns: the type of error, the number of such errors, the second table will contain the current values for the last hour with the same columns. Suppose there is a threshold, -30, if the difference in the column with the number of errors fell below this threshold - I want to write ErrorType to the result. It should be noted that there may not be any errors of a certain type in the last 12 hours, unlike errors for the current hour ... View more

Yes, of course. But it doesn`t work. I think i need to change this part of query  "| eval diff = firstCount/6 - secondCount | stats values(diff)", but i dont know how   ... View more