How to find standard deviation of the aliase

[aayushshah]

I calculate the mean of the four weeks using the aliases, but how do I calculate the standard deviation of the four points as well. 

source="..." earliest=-0d@d latest=now 
| stats count as Today 
| appendcols
 [ search source="events.log"  earliest=-7d@d latest=-6d@d 
 | stats count as SameDayOneWeekAgo] 
| appendcols
 [ search source="events.log"  earliest=-14d@d latest=-13d@d 
 | stats count as SameDayTwoWeeksAgo] 
| appendcols
 [ search source="events.log" earliest=-21d@d latest=-20d@d 
 | stats count as SameDayThreeWeeksAgo] 
| appendcols
 [ search source="events.log" earliest=-28d@d latest=-27d@d 
 | stats count as SameDayFourWeeksAgo] 
| eval mean= ((SameDayOneWeekAgo + SameDayTwoWeeksAgo + SameDayThreeWeeksAgo + SameDayFourWeeksAgo)/4)

[ITWhisperer · Accepted solution]

source="..." earliest=-0d@d latest=now 
| stats count as Today 
| append
 [ search source="events.log" earliest=-7d@d latest=-6d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-14d@d latest=-13d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-21d@d latest=-20d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-28d@d latest=-27d@d 
 | stats count] 
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev

[ITWhisperer]

Each append adds an event with the count for that day, whereas the count for today is renamed Today. The stats outputs the value of Today's count, and the average and standard deviation of the count fields.

[ITWhisperer]

You may need to wait for the events to all be read before the standard deviation is calculated

[aayushshah]

Could you explain why that works? Also I didn't want to include today's value.