stdevif
The stdevif aggregation function calculates the stdev of Expression across the group for which Predicate evaluates to true.
Use this function with the summarize, eventstats, and timestats operators.
Syntax
stdevif( Expression, Predicate )Arguments
- Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
- Predicate: When
true, the Expression calculated value will be added to the standard deviation.
Results
Returns the standard deviation of Expression across the group for which Predicate evaluates to true.
Example
This example summarizes standard deviations in byte count, by source address, for events whose destination port is higher than 1024:
dataset="cribl_search_sample" dataSource="vpcflowlogs"
| summarize stdevif(bytes, dstport>1024) by srcaddr