Splunk Search

## Stdev has a weird behaviour

Communicator

Hi everyone,

I'm seeing strange results using stdev.
I'm using the following command :

sourcetype=whatever | stats avg(timetaken) as average, stdev(timetaken) as deviation by uri | where deviation > average

And I have results that are actually showing a standard deviation that is superior to the average ... which is not mathematically possible according to me unless we have negative "timetaken" values (and that's not the case).

I tried stdevp too but it's not better.

Has anyone got a clue ?

Regards,

Mat

Tags (2)
1 Solution
Splunk Employee

This is entirely mathematically possible if you have a large range of numbers, especially when not evenly distributed.

From http://staff.argyll.epsb.ca/jreed/math30p/statistics/standardDeviation.htm the example is:

The standard deviation can be larger
than the mean. The range of numbers
has to be large for this to occur. One
such sample is {0, 0, 1, 15, 20},
where [the mean] = 7.2 and [the standard deviation] = 8.6.

--
Jesse Trucks
Minister of Magic
Path Finder

Don't forget that "standard deviation" assumes that the values are distributed in a symmetrical, Gaussian ("Normal" or "Bell") curve. As jtruck's example shows, certain data can exist that doesn't really conform to this Gaussian curve and thus the standard deviation function becomes the wrong tool to analyze the behavior of the data.

VMWare once did a nice whitepaper (http://www.vmware.com/files/pdf/vcenter/VMware-vCenter-Operations-How-Normal-Is-Your-Data-WP-EN.pdf) that explains just now non-"Normal" machine data can be.

Splunk Employee

This is entirely mathematically possible if you have a large range of numbers, especially when not evenly distributed.

From http://staff.argyll.epsb.ca/jreed/math30p/statistics/standardDeviation.htm the example is:

The standard deviation can be larger
than the mean. The range of numbers
has to be large for this to occur. One
such sample is {0, 0, 1, 15, 20},
where [the mean] = 7.2 and [the standard deviation] = 8.6.

--
Jesse Trucks
Minister of Magic
Communicator

Alright, thanks for that.
I'll go back to the Math class then 😉

Get Updates on the Splunk Community!

#### Unlock the Power of Your Splunk Data

REGISTER NOW!Tech Talk: Security EditionWednesday, August 28, 2024  |  11AM PT / 2PM ETIt’s time to accelerate ...

#### App Building 101 - Build Your First App!

REGISTER NOW!   Tech Talk: App Dev EditionTuesday, August 27, 2024  |  9AM PT / 12PM ETSplunk has tons of ...

#### Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...