Splunk Search

How to Find Standard Deviation of a Daily Volume?


I'm trying to find the standard deviation of the daily volume of traffic per host. index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) by host gives me the Total Volume per host over the last week, and index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) as VOLUME by host|eval avg=VOLUME/7 gives me the average daily volume per host. But if I try `stdev(avg)', or anything like that, I get no results. How can I get the standard deviation I want?

Note- I'm trying to do this in order to set up an alert to trigger if a daily volume falls outside the 95% confidence interval, so if there's an easier way to do that, please let me know.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...