Good Afternoon,  This is gonna be fun trying to explain. In essence I have a current report we use to review data transfers between hosts for excessive transfer that may be un expected. This is being done on Enterprise Security server on an accelerated data model. This unfortunately have to be manually reviewed and during those reviews I noticed some of the devices repeat each week, which we will consider "expected" behavior.  Along these lines I would like to see if there's anyway to correlate the previous week transfers to get the delta and filter out anything that is within something like 5% from previous week values.  I tried to make some happen with the "delta" and "timewrap" but honestly seems to be beyond my expertise and a bit of a steep learning for me. below the query producing the current report. Ideally I would like to look into the delta for gb_in or gb_out to be within the 5% but if its not feasible perhaps just do it based on the gb_total.   | tstats summariesonly=true values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.src_ip) as src_ip values(All_Traffic.dest_port) as dest_port values(All_Traffic.bytes_in) as bytes_in values(All_Traffic.bytes_out) as bytes_out values(All_Traffic.user) as user values(All_Traffic.dest_zone) as dest_zone values(All_Traffic.src_zone) as src_zone values(All_Traffic.rule) as rule from datamodel=Network_Traffic where All_Traffic.bytes_out > 10000000000 groupby All_Traffic.user, All_Traffic.src_ip, All_Traffic.dest_port,All_Traffic.dest_zone,All_Traffic.src_zone, host sourcetype index _time span=1s | eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eval total_bytes_out = sum(bytes_out) | eval total_bytes_in = sum(bytes_in) | eval gb_out = round(total_bytes_out/1024/1024/1024,2) | eval gb_in = round(total_bytes_in/1024/1024/1024,2) | sort - _time | streamstats count as No. | rename host as firewall_ip | lookup dnslookup clientip as dest_ip OUTPUT clienthost as dest_resolved_ip | lookup dnslookup clientip as src_ip OUTPUT clienthost as src_resolved_ip | eval dest_dns=if(dest_resolved_ip!="",dest_resolved_ip,dest) | eval src_dns=if(src_resolved_ip!="",src_resolved_ip,src) | eval gb_total=(gb_in+gb_out) | fields _time, firewall_ip, src_ip, src_dns, dest_ip, dest_dns, dest_port, rule, src_zone, dest_zone, gb_in, gb_out gb_total   The only other option I though about was to export the result as a lookup.lastweek and then compare it with the current week which might be a bit cleaner.        ... View more