https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283550#M85687 <P>try something like this,, </P> <P>base search | timechart span=1h mean(user) as mean, stdev(user) AS std | where std&gt;10 AND mean&gt;10</P> Thu, 27 Oct 2016 20:52:22 GMT vasanthmss 2016-10-27T20:52:22Z https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283549#M85686 <P>How to Compute the mean activity volume per user in each hour yesterday, and find the ones more than n standard deviations above the mean?</P> <P>Note: Considering user as a field</P> <P>Any ideas about writing a search which satisfies the above condition?</P> Thu, 27 Oct 2016 19:47:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283549#M85686 pavanae 2016-10-27T19:47:11Z https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283550#M85687 <P>try something like this,, </P> <P>base search | timechart span=1h mean(user) as mean, stdev(user) AS std | where std&gt;10 AND mean&gt;10</P> Thu, 27 Oct 2016 20:52:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283550#M85687 vasanthmss 2016-10-27T20:52:22Z https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283551#M85688 <P>By mean activity, I am assuming you mean the average. <BR /> | stats avg(count) by date_hour, user</P> <P>For standard deviation you can try something like below. Replace "n" with your amount.<BR /> | eventstats stdev(count) as deviation | eval outlier=deviation*"n" | where count &gt; outlier</P> Fri, 28 Oct 2016 11:50:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compute-the-mean-activity-volume-per-field-in-Splunk/m-p/283551#M85688 mgrosholz 2016-10-28T11:50:51Z