Splunk Search

Why stdev returns zero

mrcportillo
Engager

Hi there,
I'm working on this query:

index=checkin host="prod" earliest=-0d@d latest=now (description="Intento de checkin*" OR description="Checkin exitoso*") |transaction productId |
eval TotalOK=if(description=="Checkin exitoso", 1, 0) |
eval time=_time |
bucket time span=10m |
append [search index=checkin host="prod" earliest=-7d@d latest=-6d@d (description="Intento de checkin*" OR description="Checkin exitoso*") | transaction productId |
eval time=relative_time(_time,"+7d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ] |append [search index=checkin host="prod" earliest=-14d@d latest=-13d@d (description="Intento de checkin*" OR description="Checkin exitoso*") | transaction productId |
eval time=relative_time(_time,"+14d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]| append [search index=checkin host="prod" earliest=-21d@d latest=-20d@d (description="Intento de checkin*" OR description="Checkin exitoso*") | transaction productId |
eval time=relative_time(_time,"+21d") |
bucket time span=10m |
eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]|
eval theTime=strftime(time, "%F %H:%M %p") |
stats stdev(TotalOKlw) as STdesv sum(TotalOK) as CheckinToday sum(TotalOKlw) as TOTALOKlw by theTime | eval CheckinHist=(TOTALOKlw/3) | eval diferencia=CheckinHist-CheckinToday

I try to compare a historic average with an actual value, I need get the standar deviation for my historics values (3 values) and do some mathematical proportion with the diference to trigger an alarm. But the stdev give me zeros values.
What I'm doing wrong?

Thanks in advance

Cheers

Tags (3)
0 Karma

fdi01
Motivator

this eval expression ...|eval TotalOKlw=if(description=="Checkin exitoso", 1, 0) ]|....do you have 0 or 1 values to TotalOKlw.
then when you make ...|stats stdev(TotalOKlw) as STdesv ...
it is nomal that you have STdesv=0.

woodcock
Esteemed Legend

A value of "0" makes perfect sense to me. You individual field values will either be 0 or 1 due to the way you set them and my guess is that the actual values are either all 3 are 0 or all 3 are 1 which gives stdev=0.

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...