Axiom
Overview

varianceif

You can use the varianceif aggregation when analyzing logs, telemetry data, or security events where conditions on subsets of the data are critical to your analysis.

Usage#

Syntax#

summarize varianceif(Expr, Predicate)

Parameters#

  • Expr: The expression (numeric) for which you want to calculate the variance.
  • Predicate: A boolean condition that determines which records to include in the calculation.

Returns#

Returns the variance of Expr for the records where the Predicate is true. If no records match the condition, it returns null.

Use case examples#

You can use the varianceif function to calculate the variance of HTTP request durations for requests that succeeded (status == '200').

Query

['sample-http-logs']
| summarize varianceif(req_duration_ms, status == '200')

Run in Playground

Output

varianceif_req_duration_ms
15.6

This query calculates the variance of request durations for all HTTP requests that returned a status code of 200 (successful requests).

You can use the varianceif function to monitor the variance in span durations for a specific service, such as the frontend service.

Query

['otel-demo-traces']
| summarize varianceif(duration, ['service.name'] == 'frontend')

Run in Playground

Output

varianceif_duration
32.7

This query calculates the variance in the duration of spans generated by the frontend service.

The varianceif function can also be used to track the variance in request durations for requests from a specific geographic region, such as requests from geo.country == 'United States'.

Query

['sample-http-logs']
| summarize varianceif(req_duration_ms, ['geo.country'] == 'United States')

Run in Playground

Output

varianceif_req_duration_ms
22.9

This query calculates the variance in request durations for requests originating from the United States.

  • avgif: Computes the average value of an expression for records that match a given condition. Use avgif when you want the average instead of variance.
  • sumif: Returns the sum of values that meet a specified condition. Use sumif when you’re interested in totals, not variance.
  • stdevif: Returns the standard deviation of values based on a condition. Use stdevif when you want to measure dispersion using standard deviation instead of variance.

Other query languages#

Splunk SPL users

In Splunk, you would use the eval function to filter data and calculate variance for specific conditions. In APL, varianceif combines the filtering and aggregation into a single function, making your queries more concise.

Splunk example

| eval filtered_var=if(status=="200",req_duration_ms,null())
| stats var(filtered_var)

APL equivalent

['sample-http-logs']
| summarize varianceif(req_duration_ms, status == '200')
ANSI SQL users

In ANSI SQL, you typically use a CASE statement to apply conditional logic and then compute the variance. In APL, varianceif simplifies this by combining both the condition and the aggregation.

SQL example

SELECT VARIANCE(CASE WHEN status = '200' THEN req_duration_ms END)
FROM sample_http_logs;

APL equivalent

['sample-http-logs']
| summarize varianceif(req_duration_ms, status == '200')

Updated

Was this page helpful?