Try something like this | eventstats avg(count) AS pred by _time | eval upper=if(count>pred,count,pred) | eval lower=if(count<pred,count,pred) | eval lower=if(lower=0,"",lower) | eventstats avg(count) AS pred, stdev(count) as pred_stdev, by _time | eval upper=if(upper>pred+1*pred_stdev,pred_stdev*0.5+pred,upper) | eval lower=if(lower <pred-1*pred_stdev,pred_stdev*0.5+pred, lower) | stats avg(count) AS pred, stdev(upper) AS ustdev, stdev(lower) AS lstdev stdev(count) as stdev by time | eval low=pred-lstdev*(sqrt(1/(1-90/100))) | eval low=if(low<0, 1, low) | eval high=pred+ustdev*(sqrt(1/(1-90/100))) ... View more