I'm trying to find the standard deviation of the daily volume of traffic per host. index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) by host gives me the Total Volume per host over the last week, and index=index sourcetype=sourcetype earliest=-7d|stats sum(VOLUME) as VOLUME by host|eval avg=VOLUME/7 gives me the average daily volume per host. But if I try `stdev(avg)', or anything like that, I get no results. How can I get the standard deviation I want?
Note- I'm trying to do this in order to set up an alert to trigger if a daily volume falls outside the 95% confidence interval, so if there's an easier way to do that, please let me know.
