Hi All,
How can I optimize the below query? Can we convert it to tstats?
index=abc host=def* stalled
| rex field=_raw "symbol (?<symbol>.*) /"
| eval hourofday = strftime(_time, "%H")
| where NOT (hourofday>2 AND hourofday <= 4)
| timechart dc(symbol) span=15m
| eventstats avg("count") as avg stdev("count") as stdev
| eval lowerBound=-1, upperBound=(avg+stdev*exact(4))
| eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0)
| fields _time, "count", lowerBound, upperBound, isOutlier, *
| sort -_time
| head 1
| where isOutlier=1
... View more