Splunk Search

Difference between stdev and stdevp

cpeteman
Contributor

This is mostly a statics question. Is stdev(X) only using a portion of the total population or what? They results they gives are very similar but not exactly the same.

Tags (3)

bcronrath
Path Finder

what I'd like to know is how splunk is executing this. I get that sample versus population is going to be a subset verse the whole set, but what is the "whole set" in the case of stdevp? Is splunk literally going to search the entire set of raw data to do that calculation every time you use it?

m4him7
Path Finder

Here is a simple tutorial on the difference: http://www.mathsisfun.com/data/standard-deviation.html

0 Karma

sdvorak_splunk
Splunk Employee
Splunk Employee

For the sake of answering this for the future viewers. stdev(X) is using the sample based approach. Sample based is like taking a national poll, you would not poll every citizen to get an answer because it is too hard. Therefore, the larger result set you have, and the more varied the location, the more likely you will have an accurate mean. If you could poll everyone, you would have an absolutely correct answer, vs. an estimated answer.

In most cases within IT use cases, we want to use the total population because we have all the data. To use the total population, you would use stdevp(X) - the p meaning population based.

using
Explorer

I have the same question as above but about var(x) and varp(x).

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...