I am not sure what it is you are trying to accomplish but does something like this work? | gentimes start=-28 increment=1m | rename starttime as _time | streamstats count as row | eval LegionName=mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random()%4).mvindex(split("ABCDEFGHIJKLMNOPQRSTUVWXYZ",""),random()%25) | timechart span=1d limit=50 count by LegionName | fields - OTHER | untable _time LegionName ManPower | timechart avg(ManPower) by LegionName | fields - OTHER | untable _time LegionName ManPower | streamstats global=f window=10 avg(ManPower) AS mp_avg stdev(ManPower) as mp_stdev max(ManPower) as mp_max min(ManPower) as mp_min by LegionName | eval lowerBound=mp_avg-mp_stdev | eval upperBound=mp_avg+mp_stdev | eval isOutlier=if('ManPower' < lowerBound OR 'ManPower' > upperBound, "XXX".ManPower, ManPower) | search isOutlier="XXX*" | table _time, LegionName, ManPower, * ... View more