Splunk ML Toolkit - Preliminary search to look for missing or low event sourcetypes

gistfile1.txt

| tstats count where index=* AND source="/data/syslog/raw/*"  by _time sourcetype host span=1m
| streamstats avg(count) as events_avg time_window=1m 
| eventstats median("events_avg") as median p25("events_avg") as p25 p75("events_avg") as p75  by "host", "sourcetype" 
| eval IQR=(p75-p25) 
| eval lowerBound=(median-IQR*exact(3)), upperBound=(median+IQR*exact(3))
| eval isOutlier=if('events_avg' < lowerBound, 1, 0) 
| `splitby("host", "sourcetype")` 
| fields _time, "events_avg", lowerBound, upperBound, isOutlier, *
| search isOutlier=1
| stats latest(isOutlier) as isOutlier by _time host sourcetype