Warning: Splunk noob question. I have a base search: source="Administrator_logs" name="An account failed to log on" Using  https://community.splunk.com/t5/Splunk-Search/Getting-Average-Number-of-Requests-Per-Hour/m-p/73506 I can calculate hourly averages: source="Administrator_logs"name="An account failed to log on" | eval reqs = 1 | timechart span=1h per_hour(reqs) as AvgReqPerHour What I would like to do is calculate a baseline. Having never done this before my thought is to calculate the hourly average and either standard deviation and/or some percentile, e.g. 90th, for all events as apposed to the last day/week/month although that would be interesting too. Eventually, this baseline calculation will be the basis for an alert, e.g. create alert if hourly count is outside 1 stddev or 90th percentile. Q1: How do I calculate the hourly average for all events? Q2: How do I calculate the hourly standard deviation for all events? Q3: How do I calculate the hourly 90th percentile for all events? ... View more