https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67239#M16804 <P>I'm looking to calculate the Standard Deviation percentage (stdev / mean) * 100<BR /> but I'm wondering how do I craft the (eval) and then display all the fields (stdev, mean, and percentage)?</P> <P>index=generic<BR /> | stats mean(bps_out) stdev(bps_out) by router </P> <P>Thanks,</P> Mon, 28 Sep 2020 14:48:25 GMT albyva 2020-09-28T14:48:25Z https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67239#M16804 <P>I'm looking to calculate the Standard Deviation percentage (stdev / mean) * 100<BR /> but I'm wondering how do I craft the (eval) and then display all the fields (stdev, mean, and percentage)?</P> <P>index=generic<BR /> | stats mean(bps_out) stdev(bps_out) by router </P> <P>Thanks,</P> Mon, 28 Sep 2020 14:48:25 GMT https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67239#M16804 albyva 2020-09-28T14:48:25Z https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67240#M16805 <P>Hi Albyva,</P> <P>Give the following a try:</P> <PRE><CODE>index=generic | stats mean(bps_out) AS mean, stdev(bps_out) AS stdev BY router | eval stdev_percentage=(mean/stdev)*100 </CODE></PRE> <P>Let me know how you go <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>RT</P> <P><STRONG>References</STRONG>:</P> <UL> <LI>Splunk Docs: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">stats</A></LI> <LI>Splunk Docs: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/CommonStatsFunctions">Functions for stats, chart, and timechart</A></LI> <LI>Splunk Docs: <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">eval</A></LI> </UL> Wed, 18 Sep 2013 23:12:03 GMT https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67240#M16805 rturk 2013-09-18T23:12:03Z https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67241#M16806 <P>Thanks. That worked like a charm.</P> Wed, 18 Sep 2013 23:23:05 GMT https://community.splunk.com/t5/Splunk-Search/Display-Standard-Deviation-stdev-Percentage/m-p/67241#M16806 albyva 2013-09-18T23:23:05Z