https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141273#M39128 <P>This is exactly what I was looking for. Thank you</P> Mon, 14 Jul 2014 20:48:28 GMT dreamwork801 2014-07-14T20:48:28Z https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141270#M39125 <P>So I am trying to get an average duration time for request.<BR /> Currently I am using this request with gets the top 5 percent, and bottom 5 percent of times and removes them with the idea that they are outliers. I realized that this may not always be accurate if the top 5 or bottom 5 percent are actually close to the mean and not outliers. So how would I change this search to remove anything that is 3 standard deviations away from the mean?</P> <P>"Data.PlatformTeam" = "payments" | eventstats perc95(Duration) as Perc95, perc5(Duration) as Perc5 by Name| where Duration &lt; Perc95 | where Duration &gt; Perc5 | stats avg(Duration) as Average, count as Frequency by Name | sort -Average</P> Mon, 14 Jul 2014 15:56:54 GMT https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141270#M39125 dreamwork801 2014-07-14T15:56:54Z https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141271#M39126 <P>Something like this?</P> <PRE><CODE>"Data.PlatformTeam" = "payments" | eventstats mean(Duration) as mean, stdev(Duration) as stdev by Name| where abs(mean-stdev)&lt; 3 | stats avg(Duration) as Average, count as Frequency by Name | sort -Average </CODE></PRE> Mon, 14 Jul 2014 16:12:19 GMT https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141271#M39126 somesoni2 2014-07-14T16:12:19Z https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141272#M39127 <P>This will do it.</P> <PRE><CODE>"Data.PlatformTeam"="payments" | eventstats avg(duration) as avg stdev(duration) as stdev by Name | where abs(duration-avg) &lt; stdev*3 | stats avg(duration) as Average, count as Frequency by Name | sort -Average </CODE></PRE> Mon, 14 Jul 2014 17:15:13 GMT https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141272#M39127 emiller42 2014-07-14T17:15:13Z https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141273#M39128 <P>This is exactly what I was looking for. Thank you</P> Mon, 14 Jul 2014 20:48:28 GMT https://community.splunk.com/t5/Splunk-Search/Bell-Curve-Average-Duration-times/m-p/141273#M39128 dreamwork801 2014-07-14T20:48:28Z