https://community.splunk.com/t5/Splunk-Search/Outlier-Identifier-help-with-query/m-p/94332#M24310 <P>Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:</P> <P>source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description</P> Mon, 28 Sep 2020 12:03:28 GMT marywill 2020-09-28T12:03:28Z https://community.splunk.com/t5/Splunk-Search/Outlier-Identifier-help-with-query/m-p/94331#M24309 <P>I want to use the outlier function but am having trouble identifying the sources as outlier, this is what I have so far, but using stats and eval together is not working. Any help and would be greatly appreciated:</P> <PRE><CODE>source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name| outlier type=iqr | eval Description=case(count&gt;=stats max(count), "outlier", count&lt;stats max(count), "not an outlier") </CODE></PRE> Tue, 10 Jul 2012 13:22:35 GMT https://community.splunk.com/t5/Splunk-Search/Outlier-Identifier-help-with-query/m-p/94331#M24309 marywill 2012-07-10T13:22:35Z https://community.splunk.com/t5/Splunk-Search/Outlier-Identifier-help-with-query/m-p/94332#M24310 <P>Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:</P> <P>source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description</P> Mon, 28 Sep 2020 12:03:28 GMT https://community.splunk.com/t5/Splunk-Search/Outlier-Identifier-help-with-query/m-p/94332#M24310 marywill 2020-09-28T12:03:28Z