Outlier Identifier- help with query

[marywill]

I want to use the outlier function but am having trouble identifying the sources as outlier, this is what I have so far, but using stats and eval together is not working. Any help and would be greatly appreciated:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name| outlier type=iqr | eval Description=case(count>=stats max(count), "outlier", count<stats max(count), "not an outlier") 

[marywill · Accepted solution]

Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:

source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description