I have a search as follows :-
My search | timechart span=1h limit=0 count by city
Now how can I calculate the mean activity volume per city?
And how to find the one's more than n standard deviations above the mean?
this is a doc on removing outliers.
this might get your your average and stdev. create an eval to find the difference for n standard deviations above the mean.
| timechart span=1h limit=0 count by city
|stats avg(count) as avg stdev(count) as stdev by city
View solution in original post