I am attempting to take traffic logs over an arbitrary period of time and use the number of accesses and the time of those accesses and map that to a normal distribution model. My experience with Splunk is limited but I am sure that there must be a way to do this, right? My current course of thought is to discretize the data into some span of time and take the count of traffic in that time period and put it into buckets. Then use those buckets to map the data to a normal distribution to which I should be able to denote shifts in data. index="*" (host="192.168.0.*" OR dest="192.168.0.*") AND (dest!="198.24.14.0" AND src!="198.24.14.0") | timechart span=15min distinct_count(src) The above search is the baseline of what I have which represents the data that I am working with (obscured of course). Assuming arbitrary use of field (span=time) and field (dc(field)) but these won't be the only way that this search is applied. I've searched many previous threads and have tried using bins in nearly every way I can find. Unfortunately it appears that timechart() is interfering with bin() and returns output that I can't make use of. I have also tried manipulating _time with field(host/src/dest) in intervals of time but I don't know a way to get that into a variable to use later in the search. Any help would be appreciated but, I am trying to not use apps outside of "Search and Reporting". Thanks in advance ... View more