thoughts on the following:
| tstats count WHERE earliest=-7d@d latest=now index=* by index, _time span=1h
| eval group_by = floor(tonumber(strftime(_time,"%H"))/3)
| bin _time as myday span=1d
| eventstats max(_time) as _time sum(count) AS ThreeHourCount avg(count) as AverageCount stdev(count) as StdDev by index group_by myday
| eval now_hour=strftime(now(),"%H") | eval time_hour=strftime(_time,"%H") | eval time=strftime(_time,"%Y-%m-%d %H:%M")
| where time_hour=now_hour-1 and ThreeHourCount<AverageCount-(2*StdDev)
... View more