varianceif
The varianceif aggregation function calculates the variance of Expression for which Predicate evaluates to true.
Use this function with the summarize, eventstats, and timestats operators.
Syntax
varianceif( Expression, Predicate )
Arguments
- Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
- Predicate: Predicate that if
true, the Expression calculated value will be added to the variance.
Results
Returns the variance value of Expression across the group for which Predicate evaluates to true.
Example
This example summarizes the variance in byte count, by source address, for events whose destinatino port is higher than 1024:
dataset="cribl_search_sample" dataSource="vpcflowlogs"
| summarize varianceif(bytes, dstport>1024) by srcaddr