How to get hourly count, average and standard deviation over days?

[IvyZhang]

I want to create a table of count metrics based on hour of the day. So average and stdev of distinct UID at 7:00, 8:00, 9:00, etc.
For example, from 7:00-7:59AM, there are 2 users on Nov 1, 5 users on Nov 2, 6 users on Nov 3,....
I want to see the average and stdev number of users at 7:00-7:59 from Nov 1 to Nov 30.

I can't get standard deviation by using this command. How should I do it???
...|stats dc(UID) as DistinctUID by date_hour, date_mday|stats avg(DistinctUID) stdev(DistinctUID) by date_hour

Thanks!!

[ppablo]

Hi @IvyZhang

Did @martin_mueller's answer solve your question?

[martin_mueller]

Try something like this:

base search | timechart span=1h dc(UID) as DistinctUID | eval hour_of_day = strftime(_time, "%H") | eventstats avg(DistinctUID) as hourly_average stdev(DistinctUID) as hourly_stdev by hour_of_day | fields - hour_of_day