I ran the following:
source="/path/to/vpn_log" | anomalousvalue action=summary date_hour
Every event was normal (even after changing pthresh). I noticed the mean and stddev were all 0. The IsNum column is Yes as exepcted, but the UseNum column is No which seems odd.
Am I using this incorrectly (or expecting the wrong results)? Running 5.0.1. I didn't see any known bugs or see this in the changelog for 5.0.2.
Found the issue. You have to have 100 or more events in the search before the mean and standard deviation will be calculated.
View solution in original post