Why stdev returns zero

[mrcportillo]

Hi there,
I'm working on this query:

index=checkin host="prod" earliest=-0d@d latest=now (description="Intento de checkin" OR description="Checkin exitoso") |transaction productId |
eval TotalOK=if(description=="Checkin exitoso", 1, 0) |
eval time=time |
bucket time span=10m |
append [search index=checkin host="prod" earliest=-7d@d latest=-6d@d (description="Intento de checkin" OR description="Checkin exitoso") | transaction productId |
eval time=relativetime(time,"+7d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ] |append [search index=checkin host="prod" earliest=-14d@d latest=-13d@d (description="Intento de checkin" OR description="Checkin exitoso") | transaction productId |
eval time=relativetime(time,"+14d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]| append [search index=checkin host="prod" earliest=-21d@d latest=-20d@d (description="Intento de checkin" OR description="Checkin exitoso") | transaction productId |
eval time=relativetime(_time,"+21d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]|
eval theTime=strftime(time, "%F %H:%M %p") |
stats stdev(TotalOKlw) as STdesv sum(TotalOK) as CheckinToday sum(TotalOKlw) as TOTALOKlw by theTime | eval CheckinHist=(TOTALOKlw/3) | eval diferencia=CheckinHist-CheckinToday

I try to compare a historic average with an actual value, I need get the standar deviation for my historics values (3 values) and do some mathematical proportion with the diference to trigger an alarm. But the stdev give me zeros values.
What I'm doing wrong?

Thanks in advance

Cheers

[woodcock]

A value of "0" makes perfect sense to me. You individual field values will either be 0 or 1 due to the way you set them and my guess is that the actual values are either all 3 are 0 or all 3 are 1 which gives stdev=0.

[fdi01]

this eval expression ...|eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]|....do you have 0 or 1 values to TotalOKlw.
then when you make ...|stats stdev(TotalOKlw) as STdesv ...
it is nomal that you have STdesv=0.