How to calculate the mean and standard deviation in Splunk?

[pavanae]

I have a search as follows :-

My search | timechart span=1h limit=0 count by city

Now how can I calculate the mean activity volume per city?

And how to find the one's more than n standard deviations above the mean?

[cmerriman · Accepted solution]

https://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Findingandremovingoutliers
this is a doc on removing outliers.

this might get your your average and stdev. create an eval to find the difference for n standard deviations above the mean.

My search 
| timechart span=1h limit=0 count by city
|stats avg(count) as avg stdev(count) as stdev by city