I realize I'm a little late to this thread, but I had a similar issue and thought I might post my answer here for anyone running into the same problem. sourcetype=x ERROR | timechart span=1m count by error_msg limit=100 | untable _time error count | streamstats global=f window=10 avg(count) AS avg_count by error | eval lowerBound=(-avg_count*2) | eval upperBound=(avg_count*2) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, "***".count."***", count) | xyseries _time error isOutlier The above code will show you all the data for each error over time, but it will surround outliers with asterisks. If you wanted to only show data when the count is an outlier, you could run the following: sourcetype=x ERROR | timechart span=1m count by error_msg limit=100 | untable _time error count | streamstats global=f window=10 avg(count) AS avg_count by error | eval lowerBound=(-avg_count*2) | eval upperBound=(avg_count*2) | where count < lowerBound OR count > upperBound | xyseries _time error count Again, I know I'm late to the party, but hopefully this will help someone with a similar problem in the future. ... View more