Difference between stdev and stdevp

[cpeteman]

This is mostly a statics question. Is stdev(X) only using a portion of the total population or what? They results they gives are very similar but not exactly the same.

[bcronrath]

what I'd like to know is how splunk is executing this. I get that sample versus population is going to be a subset verse the whole set, but what is the "whole set" in the case of stdevp? Is splunk literally going to search the entire set of raw data to do that calculation every time you use it?

[m4him7]

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html

[sdvorak_splunk]

For the sake of answering this for the future viewers. stdev(X) is using the sample based approach. Sample based is like taking a national poll, you would not poll every citizen to get an answer because it is too hard. Therefore, the larger result set you have, and the more varied the location, the more likely you will have an accurate mean. If you could poll everyone, you would have an absolutely correct answer, vs. an estimated answer.

In most cases within IT use cases, we want to use the total population because we have all the data. To use the total population, you would use stdevp(X) - the p meaning population based.

[using]

I have the same question as above but about var(x) and varp(x).