How to calculate Anomalies for a particular field?

[pavanae]

Considering a field "user_name". What could be the search to find the anomalies per hour for each user_name in a day?

[somesoni2 · Accepted solution]

Give this a try

your base search | bucket span=1h _time | stats count by _time user_name | eventstats stdev(count) as stdev by user_name | where count>Your_MultiplicationFactor*stdev