I calculate the mean of the four weeks using the aliases, but how do I calculate the standard deviation of the four points as well. source="..." earliest=-0d@d latest=now
| stats count as Today
| appendcols
[ search source="events.log" earliest=-7d@d latest=-6d@d
| stats count as SameDayOneWeekAgo]
| appendcols
[ search source="events.log" earliest=-14d@d latest=-13d@d
| stats count as SameDayTwoWeeksAgo]
| appendcols
[ search source="events.log" earliest=-21d@d latest=-20d@d
| stats count as SameDayThreeWeeksAgo]
| appendcols
[ search source="events.log" earliest=-28d@d latest=-27d@d
| stats count as SameDayFourWeeksAgo]
| eval mean= ((SameDayOneWeekAgo + SameDayTwoWeeksAgo + SameDayThreeWeeksAgo + SameDayFourWeeksAgo)/4)
... View more