variance ​

The variance aggregation function calculates the variance of Expression across the group, considering the group as a sample.

Use this function with the summarize, eventstats, and timestats operators.

Used formula:

Syntax ​

variance( Expression )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.

Results ​

The variance value of Expression across the group.

Example ​

This example summarizes the average byte count, and corresponding variance, by source address:

dataset="cribl_search_sample" dataSource="vpcflowlogs" 
| summarize avg(bytes), variance(bytes) by srcaddr