Display Standard Deviation (stdev) Percentage

[albyva]

I'm looking to calculate the Standard Deviation percentage (stdev / mean) * 100
but I'm wondering how do I craft the (eval) and then display all the fields (stdev, mean, and percentage)?

index=generic
| stats mean(bps_out) stdev(bps_out) by router

Thanks,

[rturk · Accepted solution]

Hi Albyva,

Give the following a try:

index=generic
| stats mean(bps_out) AS mean, stdev(bps_out) AS stdev BY router
| eval stdev_percentage=(mean/stdev)*100

Let me know how you go 🙂

RT

References:

• Splunk Docs: stats
• Splunk Docs: Functions for stats, chart, and timechart
• Splunk Docs: eval

[albyva]

Thanks. That worked like a charm.