No, more like this index=myindex RecordType=abc DML_Action=INSERT earliest=-4d | bin _time span=1d | stats sum(numRows) as count by _time,table_Name | sort 0 +_time -count | streamstats count as row by _time | where row <= 10 | streamstats latest(count) as previous by table_Name window=1 global=f current=f | eval increase=round(100*(count-previous)/previous,0) The previous answer was based on the green table - since this is based on my first answer, combining the two should work for you (I removed the extra sort as this is redundant given the first sort. ... View more

Try something like this | where 'delta(avg(requestSize))' > 0 OR 'delta(avg(responseSize))' > 0 ... View more