Splunk Search

## How to find standard deviation of the aliase

Engager

I calculate the mean of the four weeks using the aliases, but how do I calculate the standard deviation of the four points as well.

``````source="..." earliest=-0d@d latest=now
| stats count as Today
| appendcols
[ search source="events.log"  earliest=-7d@d latest=-6d@d
| stats count as SameDayOneWeekAgo]
| appendcols
[ search source="events.log"  earliest=-14d@d latest=-13d@d
| stats count as SameDayTwoWeeksAgo]
| appendcols
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count as SameDayThreeWeeksAgo]
| appendcols
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count as SameDayFourWeeksAgo]
| eval mean= ((SameDayOneWeekAgo + SameDayTwoWeeksAgo + SameDayThreeWeeksAgo + SameDayFourWeeksAgo)/4)``````

Labels (1)
• ### stats

1 Solution
Legend
``````source="..." earliest=-0d@d latest=now
| stats count as Today
| append
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count]
| append
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count]
| append
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count]
| append
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count]
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev``````
Legend
``````source="..." earliest=-0d@d latest=now
| stats count as Today
| append
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count]
| append
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count]
| append
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count]
| append
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count]
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev``````
Legend

Each append adds an event with the count for that day, whereas the count for today is renamed Today. The stats outputs the value of Today's count, and the average and standard deviation of the count fields.

Legend

You may need to wait for the events to all be read before the standard deviation is calculated

Engager

Could you explain why that works? Also I didn't want to include today's value.

.conf21 Now Fully Virtual!