stdev ​

The stdev aggregation function calculates the standard deviation of Expression across the group, using Bessel’s correction for a small data set that is considered a sample.

For a large data set that is representative of the population, use the stdevp aggregation function.

Use this function with the summarize, eventstats, and timestats operators.

Used formula:

Syntax ​

stdev( Expression )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.

Results ​

The standard deviation value of Expression across the group.

Example ​

This example summarizes average traffic in bytes, and two measures of standard deviation (sample- and population-based), by source address:

dataset="cribl_search_sample" dataSource="vpcflowlogs" 
| summarize avg(bytes), stdev(bytes), stdevp(bytes) by srcaddr