---
id: outlier
title: outlier Metrics Operator
sidebar_label: outlier
description: Use the outlier metrics operator to identify data points outside the range of expected values by tracking moving average and standard deviation over a specified time window.
slug: /help/docs/metrics/metrics-operators/outlier/
canonical: https://www.sumologic.com/help/docs/metrics/metrics-operators/outlier/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

The metrics `outlier` operator identifies metrics data points that are outside the range of expected values. Outliers help you spot unusual behavior in your metrics visualizations and track the behavior over time.

`outlier` tracks the moving average and standard deviation of a time series over a specified time window, and calculates a threshold band, outside of which data points are considered outliers. You can use optional qualifiers to specify the time window, the number of standard deviations beyond which a data point is considered an outlier, and the directionality of the deviation.

:::note
You cannot directly reference the `outlier` operator in a metrics monitor, however, you can use the outlier detection method in a metrics monitor to alert based on outlier events.
:::

## Syntax

```sql
outlier [window=<time_unit_or_number>, threshold=<number>, direction=[ +- | + | - ]]
```

Where:

* `window` is the range over which to calculate the moving average and standard deviation of the time series. `window` can be specified with time units (s, m, h), or it can be specified without time units. Default: 5m.
* `threshold` is the number of standard deviations from the moving average that defines the threshold band. Default: 3
* `direction` specifies what deviation direction should trigger violations: positive deviations (`+`), negative deviations (`-`), or both (`+-`). Default: `+-`.

<img src={useBaseUrl('img/metrics/outlier-operator.png')} alt="outlier operator" style={{border: '1px solid gray'}} width="800" />

In the visualization, the threshold band is the part shaded in pink. The outlier values are represented by the pink triangles.