Working on a splunk query to find login events that occur outside of the users' typical sign in times. I do not want to get an average of all users, just the upper and lower bounds of each individual and then determine if a login event is an outlier   index=o365 sourcetype="o365:management:activity" Workload=AzureActiveDirectory Operation=UserLoggedIn | eventstats avg("_time") AS avg stdev("_time") AS stdev | foreach UserID eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(2)) | eval isOutlier=if('_time' < lowerBound OR '_time' > upperBound, 1, 0) | search isOutlier=1 ... View more