Splunk Search

How to find standard deviation of the aliase

aayushshah
Engager

I calculate the mean of the four weeks using the aliases, but how do I calculate the standard deviation of the four points as well. 

 

 

source="..." earliest=-0d@d latest=now 
| stats count as Today 
| appendcols
 [ search source="events.log"  earliest=-7d@d latest=-6d@d 
 | stats count as SameDayOneWeekAgo] 
| appendcols
 [ search source="events.log"  earliest=-14d@d latest=-13d@d 
 | stats count as SameDayTwoWeeksAgo] 
| appendcols
 [ search source="events.log" earliest=-21d@d latest=-20d@d 
 | stats count as SameDayThreeWeeksAgo] 
| appendcols
 [ search source="events.log" earliest=-28d@d latest=-27d@d 
 | stats count as SameDayFourWeeksAgo] 
| eval mean= ((SameDayOneWeekAgo + SameDayTwoWeeksAgo + SameDayThreeWeeksAgo + SameDayFourWeeksAgo)/4)

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend
source="..." earliest=-0d@d latest=now 
| stats count as Today 
| append
 [ search source="events.log" earliest=-7d@d latest=-6d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-14d@d latest=-13d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-21d@d latest=-20d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-28d@d latest=-27d@d 
 | stats count] 
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev

View solution in original post

0 Karma

ITWhisperer
Legend
source="..." earliest=-0d@d latest=now 
| stats count as Today 
| append
 [ search source="events.log" earliest=-7d@d latest=-6d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-14d@d latest=-13d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-21d@d latest=-20d@d 
 | stats count] 
| append
 [ search source="events.log" earliest=-28d@d latest=-27d@d 
 | stats count] 
| stats values(Today) as Today avg(count) as average stdev(count) as standarddev

View solution in original post

0 Karma

ITWhisperer
Legend

Each append adds an event with the count for that day, whereas the count for today is renamed Today. The stats outputs the value of Today's count, and the average and standard deviation of the count fields.

0 Karma

ITWhisperer
Legend

You may need to wait for the events to all be read before the standard deviation is calculated

0 Karma

aayushshah
Engager

Could you explain why that works? Also I didn't want to include today's value. 

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!