topic Stdev has a weird behaviour in Splunk Search

Stdev has a weird behaviour

Mahieu — Fri, 10 Oct 2014 15:59:38 GMT

Hi everyone,

I'm seeing strange results using stdev.
I'm using the following command :

sourcetype=whatever | stats avg(timetaken) as average, stdev(timetaken) as deviation by uri | where deviation > average

And I have results that are actually showing a standard deviation that is superior to the average ... which is not mathematically possible according to me unless we have negative "timetaken" values (and that's not the case).

I tried stdevp too but it's not better.

Has anyone got a clue ?

Thanks in advance for your help.

Regards,

Mat

Re: Stdev has a weird behaviour

jtrucks — Fri, 10 Oct 2014 17:22:49 GMT

This is entirely mathematically possible if you have a large range of numbers, especially when not evenly distributed.

From http://staff.argyll.epsb.ca/jreed/math30p/statistics/standardDeviation.htm the example is:

The standard deviation can be larger
than the mean. The range of numbers
has to be large for this to occur. One
such sample is {0, 0, 1, 15, 20},
where [the mean] = 7.2 and [the standard deviation] = 8.6.

Re: Stdev has a weird behaviour

Mahieu — Sat, 11 Oct 2014 10:17:21 GMT

Alright, thanks for that.
I'll go back to the Math class then 😉

Re: Stdev has a weird behaviour

prelert — Fri, 24 Oct 2014 17:15:26 GMT

Don't forget that "standard deviation" assumes that the values are distributed in a symmetrical, Gaussian ("Normal" or "Bell") curve. As jtruck's example shows, certain data can exist that doesn't really conform to this Gaussian curve and thus the standard deviation function becomes the wrong tool to analyze the behavior of the data.

VMWare once did a nice whitepaper (http://www.vmware.com/files/pdf/vcenter/VMware-vCenter-Operations-How-Normal-Is-Your-Data-WP-EN.pdf) that explains just now non-"Normal" machine data can be.