stddev_population

Learn more about the Cortex Query Language stddev_population() function used with both comp and windowcomp stages.

Syntax

comp stage

comp stddev_population(<field>) [as <alias>] by <field_1>,<field_2> [addrawdata = true|false [as <target field>]]

windowcomp stage

windowcomp stddev_population(<field>) [by <field> [,<field>,...]] [sort [asc|desc] <field1> [, [asc|desc] <field2>,...]] [between 0|null|<number>|-<number> [and 0|null|<number>|-<number>] [frame_type=range]] [as <alias>] 

Description

The stddev_population() function is used to return a single population (biased) variance value of a field for a group of rows. The function syntax and application is based on the preceding stage:

comp stage

When the stddev_population aggregation function is used with a comp stage, the function returns a single population (biased) variance value of a field over a group of rows, for all records that contain matching values for the fields identified in the by clause.

In addition, you can configure whether the raw data events are displayed by setting addrawdata to either true or false (default), which are used to configure the final comp results. When including raw data events in your query, the query runs for up to 50 fields that you define and displays up to 100 events.

windowcomp stage

When the stddev_population statistical aggregate function is used with a windowcomp stage, the function returns a single population (biased) variance value of a field for each row in the group of rows, for all records that contain matching values for the fields identified using a combination of the by clause, sort, and between window frame clause. The results are provided in a new column in the results table.

Examples

comp example

Calculates a maximum of 100 metrics_source records, where the _broker_device_id is 655AYUWF, and include a single population (biased) variance value of the total_size_rate field for a group of rows.

dataset = metrics_source 
| filter _broker_device_id = "655AYUWF" 
| comp stddev_population(total_size_rate)
| limit 100

windowcomp example

Return maximum of 100 metrics_source records and include a single population (biased) variance value of the total_size_rate field for each row in the group of rows, for all records that contain matching values in the _broker_device_id field. The results are provided in the stddev_population column.

dataset = metrics_source
| limit 100
| windowcomp stddev_population(total_size_rate) by _broker_device_id as `stddev_population`