I'm new to Splunk and having a tough time getting this to work...Trying to create an alert if the current 24hr time range is 30% less than the previous 24hr time range 3hrs ago...Any help is appreciated!       index=_internal source="*metrics.log" group="per_sourcetype_thruput" series="aws:cloudwatch" earliest=-27h latest=-3h | eval b=len(_raw) | eval MB=b/1024/1024 | timechart span=24h count as MB | timewrwap 1 series=short         ... View more