- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![pavanae pavanae](https://community.splunk.com/legacyfs/online/avatars/315752.jpg)
pavanae
Builder
10-27-2016
05:42 AM
For the below search
My search | timechart span=1h limit=0 count by student
Is it possible to list out the anomalous for each student?
Thanks in advance!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![cmerriman cmerriman](https://community.splunk.com/legacyfs/online/avatars/195284.jpg)
cmerriman
Super Champion
10-27-2016
07:04 AM
here is the doc for anomalydetection
https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Anomalydetection
this should return outliers
My search | timechart span=1h limit=0 count by student|anomalydetection method=iqr action=tf param=4 uselower=true mark=true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mgrosholz
Path Finder
10-28-2016
05:06 AM
Have you tried...
My search | timechart span=1h limit=0 count by student | anomalies by student
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![cmerriman cmerriman](https://community.splunk.com/legacyfs/online/avatars/195284.jpg)
cmerriman
Super Champion
10-27-2016
07:04 AM
here is the doc for anomalydetection
https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Anomalydetection
this should return outliers
My search | timechart span=1h limit=0 count by student|anomalydetection method=iqr action=tf param=4 uselower=true mark=true
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)