Hi, I'm trying to calculate the standard deviation for range of time to create an alert an know when the total of transactions are below 3x the standard deviation it trigger and alert. index=data |bucket _time span=5m |dedup field28 |stats count as Total_transactions, stdev(Total) as Dev by _time, field37 |rename field37 as Source |table _time, Source, Total_transactions, Dev
... View more