Splunk Search

Difference between stdev and stdevp


This is mostly a statics question. Is stdev(X) only using a portion of the total population or what? They results they gives are very similar but not exactly the same.

Tags (3)

Path Finder

what I'd like to know is how splunk is executing this. I get that sample versus population is going to be a subset verse the whole set, but what is the "whole set" in the case of stdevp? Is splunk literally going to search the entire set of raw data to do that calculation every time you use it?

Path Finder

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html

0 Karma

Splunk Employee
Splunk Employee

For the sake of answering this for the future viewers. stdev(X) is using the sample based approach. Sample based is like taking a national poll, you would not poll every citizen to get an answer because it is too hard. Therefore, the larger result set you have, and the more varied the location, the more likely you will have an accurate mean. If you could poll everyone, you would have an absolutely correct answer, vs. an estimated answer.

In most cases within IT use cases, we want to use the total population because we have all the data. To use the total population, you would use stdevp(X) - the p meaning population based.


I have the same question as above but about var(x) and varp(x).

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!