How do I create a SCOM 2012 MP calling PowerShell to calculate a moving average of an event log event count?

Question

I'm tasked to create a SCOM Monitor MP that needs to be deployed on different servers where it needs to count events in the eventlog and trigger an alert.
Before it is suggested that counting an absolute arithmetic difference is enough and offering links to such solutions, there is a "gotcha!" :
There might be one server, Server A,  that gets, say, 1000 events per hour, an increase of 100+ should trigger the alert.
On Server B, only gets 100 events per hour, and an increase of 10+ should also trigger the alert.
Therefore: You *can't* use an absolute diference, but *must* use a percentage difference.
It gets more challenging as there is another "gotcha":
Actually what should trigger the alert is a rate increase of events that falls outside of  two Standard Deviations of a Moving Average. The best example is the stock market: Your stock price moves up and down daily, but also steadily moves up due to
inflation over the years. You want a monitor that will alert you when the stock price goes above or below two standard deviations from the *moving average*.
I know how to call a PowerShell script from a SCOM Monitor, but I don't know how to get SCOM and PowerShell to "remember" prevous sampling's counts, because Monitors are state-less (e.g. "memoryless") .
Since SCOM, I'm told, can monitor any process state over time, I'm surprised that I don't see any support for statistical time-series analysis .
Any help would be appreciated.

Answer 1

Hi,
beyond advanced topic! That's what I like.
First, very good description, these are almost functional specifications!
I would also chose PowerShell.
Some time ago we did a similar situation - where
it was necessary to take into account the previous
situation|state.
We resolve this in a way that the states|values was
stored in the dedicated text file. So, at each new interval we collect new samples, read previous samples, calculate required values, stored this new calculated values, if required create property bag and trigger alert.
This is of course high level view. But in general the entire process is done in PS script.
Recently, I found that
the xml files and PS scripts bring
a lot of flexibility. Especially in building custom
diagnostics.
And there is no need to care about distribution of this files,
they may be included in the MP.
So SCOM infrastructure take care of this. 
One piece of advice: First decide
whether you need only alert
or you want to steer|change health. The first case
is simpler - you need rule. The second is more complex - you need monitor!
But of course the main part is PS script.
Regards,
Ivan