In the TimeRangePicker, choose 'custom time', then go to 'advanced'.
Enter the following as your timerange.
earliest = -20min@min
latest = -10min@min
And here's a search that will work:
<your search terms> | eval period=if(_time<relative_time(now(), "-15min@min"),"older_period", "recent_period") | eval foo=1 | chart avg(field1) over foo by period | eval diff = (recent_period-older_period)*100/older_period | where diff>X
Then save the search, click the 'schedule this search' box, and tell splunkd that if the search returns 1 or more rows, that you want it to send you an email.
here's another different search that will work too, although you have to use the same timerange
<your search terms> | timechart avg(field1) as avg span=5min | transpose | search column=avg | rename "row 1" as "older_period" | rename "row 2" as "recent_period" | eval diff = (recent_period-older_period)*100/older_period | where diff>X
... View more
