Search to identify the most volatile values in a field

[luke222010]

Hello Splunkers!

I have the following fields being populated by 1000s of values every 1 minute:

Name Cost

E.g.
Luke 1.25
Luke 1.22
Dave 2.45
Dave 2.57

Bearing in mind, there are over 1000 Cost values coming in for each Name each minute, I want to identify the biggest movers in terms of Cost over a 5 minute period thereby identifying the most volatile Names in a timechart.

Can anyone tell me how I would do this please?

[woodcock]

Like this:

... earliest=-5m latest=now | stats range(Cost) AS volatility BY Name
| sort 0 - volatility

Also maybe this:

... earliest=-24h latest=now | streamstats time_window=5m range(Cost) AS volatility BY Name
| sort 0 - volatility

[to4kawa]

1000s of values?
I don't understand 1.25 is 1000s of values.