Splunk Search

Difference between stdev and stdevp

cpeteman
Contributor

This is mostly a statics question. Is stdev(X) only using a portion of the total population or what? They results they gives are very similar but not exactly the same.

Tags (3)

bcronrath
Path Finder

what I'd like to know is how splunk is executing this. I get that sample versus population is going to be a subset verse the whole set, but what is the "whole set" in the case of stdevp? Is splunk literally going to search the entire set of raw data to do that calculation every time you use it?

m4him7
Path Finder

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html

0 Karma

sdvorak_splunk
Splunk Employee
Splunk Employee

For the sake of answering this for the future viewers. stdev(X) is using the sample based approach. Sample based is like taking a national poll, you would not poll every citizen to get an answer because it is too hard. Therefore, the larger result set you have, and the more varied the location, the more likely you will have an accurate mean. If you could poll everyone, you would have an absolutely correct answer, vs. an estimated answer.

In most cases within IT use cases, we want to use the total population because we have all the data. To use the total population, you would use stdevp(X) - the p meaning population based.

using
Explorer

I have the same question as above but about var(x) and varp(x).

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...