Hello Everyone, I am trying to find outliers in connection duration on a specific subnet but having trouble getting the outliers part to show any results. I want to get avg duration of all traffic connections from a subnet (or list of IPs) by sourceIP and application. So I am grabbing the average of connections in a 15m bin. After evaluating the outliers I want to display the time bin, sourceIP, application, AvgDuration and Outlier I have tried following 2 queries till now and neither gives results when I try to get the results: 1. index=firewall sourceip=10.0.0.1/24 | bin span=15m _time | stats avg(duration) AS AvgTotal by sourceip, _time, app | eval outlier=if(duration>AvgTotal*3,1,0) | table _time sourceip app AvgDuration outlier 2. index=firewall sourceip=10.1.11.1 | timechart span=15m avg(duration) AS AvgDuration by sourceip, _time, app | eval outlier=if(duration>AvgDuration*3,1,0) | table _time sourceip app AvgDuration outlier This is just a test query I am trying, with plans to build on it. I think there something wrong in how I am calling the table. What am I doing wrong in the 2 queries? ... View more