Hi Folks. I'm not experienced with Splunk but have gone through the Search tutorial and have checked this blog trying to find someone with a similar issue with no luck. I'm looking at trying to show values that are above the average of the same set of values. The first bit I'm doing is ... | top src limit=0 countfield=MAX which works fine. The second bit I'm doing is ... | top src limit=0 countfield=MAX | stats avg(MAX) as AVG which works fine and gives me the average of MAX. What I'm then trying to do is compare MAX to AVG and only show those MAX value which are higher than AVG. The following search doesn't work but it kind of shows what I'm trying to do. ...top src limit=0 countfield=MAX | stats avg(MAX) as AVG | where MAX>AVG I think the issue is that the stats avg command is filtering out the MAX results, so there's nothing left for the "where" at the end. Once I get this working, I'll probably use something like "anomalies" to just show MAX values a particular distance from AVG. ... View more