Axiom
Overview

stdev

Use the stdev function to determine how spread out values like request duration, span duration, or response times are. This is particularly helpful when analyzing data trends and identifying inconsistencies, outliers, or abnormal behavior.

Usage#

Syntax#

stdev(numeric_field)

Parameters#

  • numeric_field: The field containing numeric values for which the standard deviation is calculated.

Returns#

The stdev aggregation returns a single numeric value representing the standard deviation of the specified numeric field in the dataset.

Use case examples#

You can use the stdev aggregation to analyze HTTP request durations and identify performance variations across different requests. For instance, you can calculate the standard deviation of request durations to identify potential anomalies.

Query

['sample-http-logs']
| summarize req_duration_std = stdev(req_duration_ms)

Run in Playground

Output

req_duration_std
345.67

This query calculates the standard deviation of the req_duration_ms field in the sample-http-logs dataset, helping to understand how much variability there is in request durations.

In distributed tracing, calculating the standard deviation of span durations can help identify inconsistent spans that might indicate performance issues or bottlenecks.

Query

['otel-demo-traces']
| summarize span_duration_std = stdev(duration)

Run in Playground

Output

span_duration_std
0:00:02.456

This query computes the standard deviation of span durations in the otel-demo-traces dataset, providing insight into how much variation exists between trace spans.

In security logs, the stdev function can help analyze the response times of various HTTP requests, potentially identifying patterns that might be related to security incidents or abnormal behavior.

Query

['sample-http-logs']
| summarize resp_time_std = stdev(req_duration_ms) by status

Run in Playground

Output

status resp_time_std
200 123.45
500 567.89

This query calculates the standard deviation of request durations grouped by the HTTP status code, providing insight into the performance of different status codes.

  • avg: Calculates the average value of a numeric field. Use avg to understand the central tendency of the data.
  • min: Returns the smallest value in a numeric field. Use min when you need to find the minimum value.
  • max: Returns the largest value in a numeric field. Use max to identify the peak value in a dataset.
  • sum: Adds up all the values in a numeric field. Use sum to get a total across records.
  • count: Returns the number of records in a dataset. Use count when you need the number of occurrences or entries.

Other query languages#

Splunk SPL users

In Splunk SPL, the stdev aggregation function works similarly but has a different syntax. While SPL uses the stdev command within the stats function, APL users find the aggregation works similarly in APL with just minor differences in syntax.

Splunk example

| stats stdev(duration) as duration_std

APL equivalent

['dataset']
| summarize duration_std = stdev(duration)
ANSI SQL users

In ANSI SQL, the standard deviation is computed using the STDDEV function. APL's stdev function is the direct equivalent of SQL’s STDDEV, although APL uses pipes (|) for chaining operations and different keyword formatting.

SQL example

SELECT STDDEV(duration) AS duration_std FROM dataset;

APL equivalent

['dataset']
| summarize duration_std = stdev(duration)

Updated

Was this page helpful?