Learn more about the Cortex Query Language stddev_population()
function used with both comp
and windowcomp
stages.
Syntax
comp stddev_population(<field>) [as <alias>] by <field_1>,<field_2> [addrawdata = true|false [as <target field>]]
windowcomp stddev_population(<field>) [by <field> [,<field>,...]] [sort [asc|desc] <field1> [, [asc|desc] <field2>,...]] [between 0|null|<number>|-<number> [and 0|null|<number>|-<number>] [frame_type=range]] [as <alias>]
Description
The stddev_population()
function is used to return a single population (biased) variance value of a field for a group of rows. The function syntax and application is based on the preceding stage:
When the stddev_population
aggregation function is used with a comp stage, the function returns a single population (biased) variance value of a field over a group of rows, for all records that contain matching values for the fields identified in the by
clause.
In addition, you can configure whether the raw data events are displayed by setting addrawdata
to either true
or false
(default), which are used to configure the final comp
results. When including raw data events in your query, the query runs for up to 50 fields that you define and displays up to 100 events.
When the stddev_population
statistical aggregate function is used with a windowcomp stage, the function returns a single population (biased) variance value of a field for each row in the group of rows, for all records that contain matching values for the fields identified using a combination of the by
clause, sort
, and between
window frame clause. The results are provided in a new column in the results table.
Examples
Calculates a maximum of 100 metrics_source
records, where the _broker_device_id
is 655AYUWF
, and include a single population (biased) variance value of the total_size_rate
field for a group of rows.
dataset = metrics_source | filter _broker_device_id = "655AYUWF" | comp stddev_population(total_size_rate) | limit 100
Return maximum of 100 metrics_source
records and include a single population (biased) variance value of the total_size_rate
field for each row in the group of rows, for all records that contain matching values in the _broker_device_id
field. The results are provided in the stddev_population
column.
dataset = metrics_source | limit 100 | windowcomp stddev_population(total_size_rate) by _broker_device_id as `stddev_population`