Add calculated threshold line on splunk timechart

Question

I have a simple chart which shows the bottom 5 servers by number of request per minute. I'm looking to add a calculated threshold overlay line that is the average number of requests across all servers minus one standard deviation. I have been searching for hours but I have not been able to find anything.

Current Search Query:

sourcetype=x source=y host="server*" ENTERING | timechart useother=f span=1m count by host WHERE count in bottom5

I essentially want something like the below (which doesn't work of course):

sourcetype=x source=y host="server*" ENTERING | timechart useother=f span=1m count by host WHERE count in bottom5 | eval threshold=(avg(countByHost) - stdev(countByHost))

Answer 1

Try this

sourcetype=x source=y host="server*" ENTERING | timechart useother=f span=1m avg(count) as avgByHost, stdev(count) as stdevByHost , count by host WHERE count in bottom5 | eval threshold=avgByHost-stdevByHost | fields - threshold, count