I am trying to write a query which returns the values in myCol
which have a count greater than 3 times the standard deviation of the counts of values in myCol
. I tried the following:
source="mySource" | stats count as myCount by myCol | append [ | search source="mySource" | stats count as myCount by myCol | stats stdev(myCount) as deviation ] | eval outlier=deviation*3 | stats values(myCount) as myCount, values(outlier) as outlier | where myCount > outlier | table myCol, myCount
However, no results are returned. How can I achieve this?
Try this as the core of your search:
source="mySource" | stats count as myCount by myCol | eventstats stdev(myCount) as deviation | eval outlier=deviation*3 | where myCount > outlier