Alert if value is greater than 2xSTDEV

Hi,

I am trying to find outliers by using the idea of a Bell Curve. I have a search that provides stats on mean, standard deviation, and 2 standard deviations. The idea is to get an alert if the value of a field (totalMB) is greater than 2 standard deviations.

source=x action="1" | eval megabytes=bytes_out/1024/1024 | stats sum(megabytes) as totalMB by src_user | stats mean(totalMB) stdev(totalMB) as "deviation" | eval outlier=deviation*2 | where totalMB > outlier | table src_user totalMB

When I leave out | where totalMB < outlier | table src_user totalMB , the math checks out for mean and standard deviations. But I cannot get the fields to pop up (whether I do less than or greater than the falue outlier. There are matching results, but the search returns "0 results found".

Any help is appreciated.

Thanks,

B