How to calculate variance in an array?

[dtakacssplunk]

I would like to create a column that tells me the variance for the array   

| makeresults 
| eval raw="1	session1	O1	S1	5 6 7 9#
2	session2	O2	S2	99 55 77 999#
3	session3	O1	S1	995 55 77 999#
4	session4	O1	S1	1 2 4 1#" 
| makemv raw delim="#" 
| mvexpand raw 
| rename raw as _raw 
| rex "(?<User>\S+)\s+(?<ClientSession>\S+)\s+(?<Organization>\S+)\s+(?<Section>\S+)\s+(?<downloadspeed_file1>\S+)\s+(?<downloadspeed_file2>\S+)\s+(?<downloadspeed_file3>\S+)\s+(?<downloadspeed_file4>\S+)" 
| eval downloadSpeedsArray=json_array(downloadspeed_file1, downloadspeed_file2, downloadspeed_file3, downloadspeed_file4)
| table User ClientSession Organization Section downloadspeed_file1, downloadspeed_file2, downloadspeed_file3, downloadspeed_file4 downloadSpeedsArray variance

can you please help me how to calculate this column.  Is the variance normalized across rows?

[richgalloway]

I think you'll need to write an external command for that.

[dtakacssplunk]

how do I do that?  I'm not familiar with external functions.

[richgalloway]

There's too much to it to get into here, but Splunk has documentation on the subject.  See https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/