Using join to see the changes between the original search and the outlier search, implementing nullif to find the differences, and imbedding he null if in an evalif function fixes the issue, as seen below:
source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS original_count | join type=inner User_Name[search source="wineventlog:security" EventCode=528 OR EventCode=540 OR EventCode=4624 User_Name!="-" | stats count by User_Name | rename count AS outlier_count | outlier type=iqr] | eval Description=if(nullif(outlier_count,original_count)==outlier_count,"outlier","not an outlier") | table User_Name, original_count, outlier_count, Description
... View more