Why do I keep getting outliers in network?

[Hassan989]

Hi Team, 

I'm trying to find outliers in the network kpi for a project but every time I run this query I get 0 outliers so I'm stuck on what's wrong with my query. 

this is it:

| mstats avg("Network_Interface.Bytes_Received/sec") As Packets_Received stdev("Network_Interface.Bytes_Received/sec") as stdev WHERE index=dcn_nc01_os AND host = HIC026117
| eval lowerBound=(Packets_Received-stdev*exact(2)), upperBound=(Packets_Received+stdev*exact(2))
| eval isOutlier=if('Network_Interface.Bytes_Received/sec' < lowerBound OR 'Network_Interface.Bytes_Received/sec' > upperBound, 1, 0)

any ideas or fixes are much appreciated! 

[inventsekar]

Hi @Hassan989 ... troubleshooting this requires more details from your side. 

1) when you run the first portion of that search query, do you get any results?

| mstats avg("Network_Interface.Bytes_Received/sec") As Packets_Received stdev("Network_Interface.Bytes_Received/sec") as stdev WHERE index=dcn_nc01_os AND host = HIC026117

2) if yes, then we should troubleshoot the remaining SPL query. 

3) if you dont get any results, then, pls suggest us.. if the apps, add-ons are installed or not.. how many UFs are sending network events.. many other questions will raise depending on above answers..