https://community.splunk.com/t5/Splunk-Search/Top-10-event-counts-per-day/m-p/18866#M2800 <P>example with an eval to calculate the difference, and sort the hosts<BR /> <PRE><BR /> mysearchthatcalculatesall | stats max(event) AS current avg(average_number_of_events) AS average by host date_mday<BR /> | eval outlier_count=current-average | where outlier&gt;0 <BR /> | sort -outlier | head 10<BR /> </PRE></P> Mon, 28 Sep 2020 13:01:43 GMT yannK 2020-09-28T13:01:43Z https://community.splunk.com/t5/Splunk-Search/Top-10-event-counts-per-day/m-p/18865#M2799 <P>I have a search that gives me the event counts for each host every hour and compares that count against a running average of event counts for each host. When a host has a higher event count than the average for that hour it is marked as an outlier. I want to table the top 10 outliers based on the difference between the event count at that hour and the running average for each day.</P> <P>So I'll have 10 hosts for Monday, Tuesday, Wednesday, etc. Is something like this possible? I have the difference already in my data set.</P> <P>Thanks for the help.</P> Thu, 26 Jul 2012 20:47:18 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-event-counts-per-day/m-p/18865#M2799 Volto 2012-07-26T20:47:18Z https://community.splunk.com/t5/Splunk-Search/Top-10-event-counts-per-day/m-p/18866#M2800 <P>example with an eval to calculate the difference, and sort the hosts<BR /> <PRE><BR /> mysearchthatcalculatesall | stats max(event) AS current avg(average_number_of_events) AS average by host date_mday<BR /> | eval outlier_count=current-average | where outlier&gt;0 <BR /> | sort -outlier | head 10<BR /> </PRE></P> Mon, 28 Sep 2020 13:01:43 GMT https://community.splunk.com/t5/Splunk-Search/Top-10-event-counts-per-day/m-p/18866#M2800 yannK 2020-09-28T13:01:43Z