https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282642#M85348 <P>Have you tried...</P> <PRE><CODE>My search | timechart span=1h limit=0 count by student | anomalies by student </CODE></PRE> Fri, 28 Oct 2016 12:06:10 GMT mgrosholz 2016-10-28T12:06:10Z https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282640#M85346 <P>For the below search</P> <P>My search | timechart span=1h limit=0 count by student</P> <P>Is it possible to list out the anomalous for each student?</P> <P>Thanks in advance!</P> Thu, 27 Oct 2016 12:42:35 GMT https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282640#M85346 pavanae 2016-10-27T12:42:35Z https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282641#M85347 <P>here is the doc for anomalydetection</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Anomalydetection">https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Anomalydetection</A></P> <P>this should return outliers</P> <PRE><CODE>My search | timechart span=1h limit=0 count by student|anomalydetection method=iqr action=tf param=4 uselower=true mark=true </CODE></PRE> Thu, 27 Oct 2016 14:04:06 GMT https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282641#M85347 cmerriman 2016-10-27T14:04:06Z https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282642#M85348 <P>Have you tried...</P> <PRE><CODE>My search | timechart span=1h limit=0 count by student | anomalies by student </CODE></PRE> Fri, 28 Oct 2016 12:06:10 GMT https://community.splunk.com/t5/Splunk-Search/What-is-anomalies-and-how-can-I-calculate-for-a-specific-field/m-p/282642#M85348 mgrosholz 2016-10-28T12:06:10Z