Why IQR shows me only 10,000 results ?

[zacksoft]

I'm trying to find outlier using IQR method suggested by Splunk. I wonder why the statistics only shows 10,000 results !
https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Findingandremovingoutliers

[mayurr98]

can you share your search query?

[zacksoft]

| eval _time=(round(strptime(time, "%Y-%m-%d %H:%M:%SZ")))
| eventstats median("Run_Time") as median p25("Run_Time") as p25 p75("Run_Time") as p75
| eval IQR=(p75-p25)
| eval lowerBound=(median-IQR)
| eval upperBound=(median+IQR*20)
| eval isOutlier=if('Run_Time' < lowerBound OR 'Run_Time' > upperBound, 1, 0)
| fields "_time", "symbol", "sourcetype", "time", "Run_Time", "lowerBound", "upperBound", "isOutlier"
| table _time, symbol, sourcetype, time, Run_Time, lowerBound, upperBound, isOutlier
| sort -isOutlier

[cmerriman · Accepted solution]

are you using the sort command? sort automatically truncates results. try |sort 0 -<fieldname>
http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Sort

[zacksoft]

Adding |sort 0 - helped. But in statistics tab it still shows as 10,000 entries.
Is this something to do with IQR approach ?

While I attempted the "lower and upper boundaries of an acceptable range to identify outliers" , there also it was 10,000 values !!!

[cmerriman]

can you share your search?

[zacksoft]

This is using IQR.

| eval _time=(round(strptime(time, "%Y-%m-%d %H:%M:%SZ")))
| eventstats median("Run_Time") as median p25("Run_Time") as p25 p75("Run_Time") as p75
| eval IQR=(p75-p25)
| eval lowerBound=(median-IQR)
| eval upperBound=(median+IQR*20)
| eval isOutlier=if('Run_Time' < lowerBound OR 'Run_Time' > upperBound, 1, 0)
| fields "_time", "symbol", "sourcetype", "time", "Run_Time", "lowerBound", "upperBound", "isOutlier"
| table _time, symbol, sourcetype, time, Run_Time, lowerBound, upperBound, isOutlier
| sort -isOutlier

[cmerriman]

you're going to need | sort 0 -isOutlier on the end to remove the 10,000 limit. the rest of it shouldn't matter. you also don't need both fields and table, you can just use one or the other.

[zacksoft]

Thank you @cmerriman