I have a set of web page performance measurements spanning quite some time, generated by an external monitoring provider. I want to be able to find the mean page performance after removing spikes caused by external factors out of our control, and am thinking along the lines of using a truncated mean as a best measure of central tendency but am having problems with the implementation. Here's my thinking so far: find all page render times for the past 7 days order by render time remove the top and bottom 2.5% calculate truncated mean from remaining values I can calculate how many values I should be removing easily, but can't work out how to actually remove them. If there's a better way, I'd love to know it! My query string (not yet working properly) so far is: startdaysago=7 monitorid=<foo> | eventstats count(rendertime) as nresults | eval nkeep=nresults-ceil(nresults*0.05) | sort 0 -rendertime | head nkeep but of course head can't take a parameter that's not an integer. ... View more