Compare count of errors in last 12h against last multiple periods of 12h

Hi Preben902 

You can do the following query:

let counts_tbl = materialize(Event
| where TimeGenerated > ago(7d)
| where EventLevelName == "Warning" or EventLevelName == "Error"
| summarize count() by bin(TimeGenerated, 12h)
| order by TimeGenerated desc 
| extend rid = row_number()
);
counts_tbl
| where rid > 1     //  all but current 12h bin
| summarize maxi = max(count_)
| extend dummy=1
| join (counts_tbl
| where rid == 1    //  current 12h bin
| extend dummy=1)
on dummy
| project maxi, current=count_, diff=count_-maxi

 but if you want to detect anomaly of the last point I recommend building a time series of counts using make-series and then use series_decompose_anomalies function.

Thanks

Adi