https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332567#M163382 <P>are you using the <CODE>sort</CODE> command? sort automatically truncates results. try <CODE>|sort 0 -&lt;fieldname&gt;</CODE><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Sort">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Sort</A></P> Wed, 24 Jan 2018 12:41:56 GMT cmerriman 2018-01-24T12:41:56Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332566#M163381 <P>I'm trying to find outlier using IQR method suggested by Splunk. I wonder why the statistics only shows 10,000 results !<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Findingandremovingoutliers">https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Findingandremovingoutliers</A></P> Wed, 24 Jan 2018 12:26:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332566#M163381 zacksoft 2018-01-24T12:26:43Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332567#M163382 <P>are you using the <CODE>sort</CODE> command? sort automatically truncates results. try <CODE>|sort 0 -&lt;fieldname&gt;</CODE><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Sort">http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Sort</A></P> Wed, 24 Jan 2018 12:41:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332567#M163382 cmerriman 2018-01-24T12:41:56Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332568#M163383 <P>Adding |sort 0 - helped. But in statistics tab it still shows as 10,000 entries.<BR /> Is this something to do with IQR approach ?</P> <P>While I attempted the "lower and upper boundaries of an acceptable range to identify outliers" , there also it was 10,000 values !!!</P> Wed, 24 Jan 2018 15:09:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332568#M163383 zacksoft 2018-01-24T15:09:46Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332569#M163384 <P>can you share your search? </P> Wed, 24 Jan 2018 16:31:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332569#M163384 cmerriman 2018-01-24T16:31:44Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332570#M163385 <P>can you share your search query?</P> Wed, 24 Jan 2018 16:40:37 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332570#M163385 mayurr98 2018-01-24T16:40:37Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332571#M163386 <P>This is using IQR.</P> <P>| eval _time=(round(strptime(time, "%Y-%m-%d %H:%M:%SZ")))<BR /> | eventstats median("Run_Time") as median p25("Run_Time") as p25 p75("Run_Time") as p75 <BR /> | eval IQR=(p75-p25) <BR /> | eval lowerBound=(median-IQR) <BR /> | eval upperBound=(median+IQR*20) <BR /> | eval isOutlier=if('Run_Time' &lt; lowerBound OR 'Run_Time' &gt; upperBound, 1, 0) <BR /> | fields "_time", "symbol", "sourcetype", "time", "Run_Time", "lowerBound", "upperBound", "isOutlier"<BR /> | table _time, symbol, sourcetype, time, Run_Time, lowerBound, upperBound, isOutlier<BR /> | sort -isOutlier</P> Tue, 29 Sep 2020 17:51:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332571#M163386 zacksoft 2020-09-29T17:51:56Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332572#M163387 <P>| eval _time=(round(strptime(time, "%Y-%m-%d %H:%M:%SZ")))<BR /> | eventstats median("Run_Time") as median p25("Run_Time") as p25 p75("Run_Time") as p75 <BR /> | eval IQR=(p75-p25) <BR /> | eval lowerBound=(median-IQR) <BR /> | eval upperBound=(median+IQR*20) <BR /> | eval isOutlier=if('Run_Time' &lt; lowerBound OR 'Run_Time' &gt; upperBound, 1, 0) <BR /> | fields "_time", "symbol", "sourcetype", "time", "Run_Time", "lowerBound", "upperBound", "isOutlier"<BR /> | table _time, symbol, sourcetype, time, Run_Time, lowerBound, upperBound, isOutlier<BR /> | sort -isOutlier</P> Tue, 29 Sep 2020 17:51:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332572#M163387 zacksoft 2020-09-29T17:51:59Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332573#M163388 <P>you're going to need <CODE>| sort 0 -isOutlier</CODE> on the end to remove the 10,000 limit. the rest of it shouldn't matter. you also don't need both <CODE>fields</CODE> and <CODE>table</CODE>, you can just use one or the other.</P> Mon, 29 Jan 2018 13:27:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332573#M163388 cmerriman 2018-01-29T13:27:51Z https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332574#M163389 <P>Thank you @cmerriman </P> Mon, 29 Jan 2018 13:49:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-IQR-shows-me-only-10-000-results/m-p/332574#M163389 zacksoft 2018-01-29T13:49:33Z