Splunk Search

Difference between stdev and stdevp


This is mostly a statics question. Is stdev(X) only using a portion of the total population or what? They results they gives are very similar but not exactly the same.

Tags (3)

Path Finder

what I'd like to know is how splunk is executing this. I get that sample versus population is going to be a subset verse the whole set, but what is the "whole set" in the case of stdevp? Is splunk literally going to search the entire set of raw data to do that calculation every time you use it?

Path Finder

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html

0 Karma

Splunk Employee
Splunk Employee

For the sake of answering this for the future viewers. stdev(X) is using the sample based approach. Sample based is like taking a national poll, you would not poll every citizen to get an answer because it is too hard. Therefore, the larger result set you have, and the more varied the location, the more likely you will have an accurate mean. If you could poll everyone, you would have an absolutely correct answer, vs. an estimated answer.

In most cases within IT use cases, we want to use the total population because we have all the data. To use the total population, you would use stdevp(X) - the p meaning population based.


I have the same question as above but about var(x) and varp(x).

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...