Query to return events whose count is more than 3 times standard deviation,Find outlier events, using different time ranges for events and for stats

[kalua]

I am trying to write a query which returns the values in myCol which have a count greater than 3 times the standard deviation of the counts of values in myCol. I tried the following:

source="mySource" | stats count as myCount by myCol | append [ | search source="mySource" | stats count as myCount by myCol | stats stdev(myCount) as deviation ] | eval outlier=deviation*3 | stats values(myCount) as myCount, values(outlier) as outlier | where myCount > outlier | table myCol, myCount

However, no results are returned. How can I achieve this?

[woodcock]

Try this as the core of your search:

source="mySource" | stats count as myCount by myCol | eventstats stdev(myCount) as deviation | eval outlier=deviation*3 | where myCount > outlier