You should create your own limits so you understand exactly how it works and can adjust it as needed.. You'll ned to knock the dust off those old statistics books and find the equations for the UCL and LCL and apply it here. I've posted about this a lot, here's an example
This is the output of a query after the arguements have been passed into the macro, so some of the numerical values will represent a value you pass. These include, confidence interval
| eval upper=if((count > pred),count,pred), lower=if((count < pred),count,pred), lower=if((lower == 0),"",lower)
| eventstats avg(count) AS pred, stdev(count) as pred_stdev, by time, customer
| eval upper=if((upper > (pred + (1 * pred_stdev))),((pred_stdev * 0.5) + pred),upper), lower=if((lower < (pred - (1 * pred_stdev))),((pred_stdev * 0.5) + pred),lower)
| stats avg(count) AS pred, stdev(upper) AS ustdev, stdev(lower) AS lstdev stdev(count) as stdev by time, customer
| eval low=(pred - (lstdev * (exact(3.1622776601683795)))), low=if((low < 0),1,low), high=(pred + (ustdev * (exact(3.1622776601683795)))), _time=time
... View more