Top 10 event counts per day

[Volto]

I have a search that gives me the event counts for each host every hour and compares that count against a running average of event counts for each host. When a host has a higher event count than the average for that hour it is marked as an outlier. I want to table the top 10 outliers based on the difference between the event count at that hour and the running average for each day.

So I'll have 10 hosts for Monday, Tuesday, Wednesday, etc. Is something like this possible? I have the difference already in my data set.

Thanks for the help.

[yannK]

example with an eval to calculate the difference, and sort the hosts

mysearchthatcalculatesall | stats max(event) AS current avg(average_number_of_events) AS average by host date_mday

| eval outlier_count=current-average | where outlier>0 

| sort -outlier  | head 10