It depends on the time range you're running it over. (and yes, it's not a fastest search). It relies on the fact that you'd have a high relatively short-lived spike. Assuming normal distribution (which is a typical assumption for real-life data) 3-sigma range should contain 99,7% of normally distributed data. Hence if you have a short spike, it should not affect your std dev too much so the scan should stand out. But if you search over a time range of which anomalous scan numbers are a significant part it will significantly affect the std dev so your bounds might get way too broad. So it does make sense but might need tweaking. If you don't mind dealing with FPs you might want to lower the bound limits - switch to 2-sigma. ... View more