anomalousvalue misuse or bug?

[steve]

I ran the following:

source="/path/to/vpn_log" | anomalousvalue action=summary date_hour

Every event was normal (even after changing pthresh). I noticed the mean and stddev were all 0. The IsNum column is Yes as exepcted, but the UseNum column is No which seems odd.

Am I using this incorrectly (or expecting the wrong results)? Running 5.0.1. I didn't see any known bugs or see this in the changelog for 5.0.2.

[steve · Accepted solution]

Found the issue. You have to have 100 or more events in the search before the mean and standard deviation will be calculated.