Splunk Search

## Stdev has a weird behaviour

Communicator

Hi everyone,

I'm seeing strange results using stdev.
I'm using the following command :

sourcetype=whatever | stats avg(timetaken) as average, stdev(timetaken) as deviation by uri | where deviation > average

And I have results that are actually showing a standard deviation that is superior to the average ... which is not mathematically possible according to me unless we have negative "timetaken" values (and that's not the case).

I tried stdevp too but it's not better.

Has anyone got a clue ?

Regards,

Mat

Tags (2)
1 Solution
Splunk Employee

This is entirely mathematically possible if you have a large range of numbers, especially when not evenly distributed.

From http://staff.argyll.epsb.ca/jreed/math30p/statistics/standardDeviation.htm the example is:

The standard deviation can be larger
than the mean. The range of numbers
has to be large for this to occur. One
such sample is {0, 0, 1, 15, 20},
where [the mean] = 7.2 and [the standard deviation] = 8.6.

--
Jesse Trucks
Minister of Magic
Path Finder

Don't forget that "standard deviation" assumes that the values are distributed in a symmetrical, Gaussian ("Normal" or "Bell") curve. As jtruck's example shows, certain data can exist that doesn't really conform to this Gaussian curve and thus the standard deviation function becomes the wrong tool to analyze the behavior of the data.

VMWare once did a nice whitepaper (http://www.vmware.com/files/pdf/vcenter/VMware-vCenter-Operations-How-Normal-Is-Your-Data-WP-EN.pdf) that explains just now non-"Normal" machine data can be.

Splunk Employee

This is entirely mathematically possible if you have a large range of numbers, especially when not evenly distributed.

From http://staff.argyll.epsb.ca/jreed/math30p/statistics/standardDeviation.htm the example is:

The standard deviation can be larger
than the mean. The range of numbers
has to be large for this to occur. One
such sample is {0, 0, 1, 15, 20},
where [the mean] = 7.2 and [the standard deviation] = 8.6.

--
Jesse Trucks
Minister of Magic
Communicator

Alright, thanks for that.
I'll go back to the Math class then 😉

Get Updates on the Splunk Community!

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...

#### Index This | What has a tail and a head but no body?

July 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...