Try something like this Your base search earliest=-14d@d latest=@d [search your base search earliest=@d latest=now | top 10 product showperc=f | table product | bucket span=1d _time | stats count by product _time | stats avg(count) as "Last2Weeks" by product | append [search your base search earliest=@d latest=now | top 10 product showperc=f | rename count as "Today"] | stats values(*) as * by product | where Today>1.25*Last2Week Basically, get the top 10 products today, find the avg daily count for them in last 2 weeks, and compare them with today's count. My example threshold is 1.25 times (configured yours). The all time best sellers will not show much deviation from the average, so using that assumption for basis of this. ... View more

Ice bear for President indeed! ... View more