It sounds like you want to use something like eventstats for what you're trying to accomplish. Eventstats gives you a way of "zooming out" and giving you metrics from the wider set of events to use for comparison to values in individual events. Try something like this: <base search> | stats avg(fieldName) as source_average by eventName, source | eventstats avg(source_average) as combined_average by eventName | eval pct_diff=abs(100*(combined_average-source_average/combined_average)) | where pct_diff > 50 ... View more