> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_sample_with_comp_stage.md).

# stddev\_sample (comp)

Use the `stddev_sample()` function to compute the sample standard deviation of a specified numeric field across all rows in each group within the `comp` stage. Sample standard deviation uses Bessel's correction (dividing by N-1 instead of N) and is appropriate when the data represents a sample from a larger population. This is equivalent to `STDDEV_SAMP` in SQL.

## Syntax

```sql
| comp stddev_sample(<field>) [by <group_field1>, <group_field2>, ...] [as <alias>]
```

## Parameters

| Name          | Type    | Required | Description                                                                                                 |
| ------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------- |
| `field`       | numeric | Yes      | The numeric field from which to compute the sample standard deviation.                                      |
| `group_field` | any     | No       | One or more fields to group the results by. If omitted, all rows are treated as a single group.             |
| `alias`       | string  | No       | An alias for the output field. If not specified, the output field name defaults to `stddev_sample_<field>`. |

## Returns

**Type**: numeric (float)

**Description**: The `stddev_sample()` function returns the sample standard deviation of the specified field within each group. Returns NULL if there are fewer than two non-NULL values in the group.

## Usage notes

* **Sample vs. population**: Use `stddev_sample()` when the data is a sample from a larger population. Use `stddev_population()` when the data represents the entire population.
* **Formula**: Sample standard deviation is calculated as: `sqrt(sum((x - mean)^2) / (N - 1))`, where N is the number of non-NULL values (Bessel's correction).
* **Minimum values**: Requires at least two non-NULL values to produce a result. Returns NULL for groups with fewer than two values.
* **Null handling**: NULL values are ignored in the computation.
* **Data types**: Only works with numeric fields.

## Examples

### Example 1: Sample standard deviation of response times per host

**Goal**: Compute the sample standard deviation of response times for each host.

**XQL code**:

```sql
dataset = xdr_data
| comp stddev_sample(action_total_time) by agent_hostname as sample_stddev
```

**Explanation**: The `stddev_sample()` function computes the sample standard deviation of `action_total_time` for each unique `agent_hostname`, using Bessel's correction for unbiased estimation.

**Output**:

| AGENT\_HOSTNAME | SAMPLE\_STDDEV |
| --------------- | -------------- |
| workstation-1   | 14.42          |
| workstation-2   | 9.62           |

### Example 2: Overall sample standard deviation

**Goal**: Compute the sample standard deviation of bytes transferred across all events.

**XQL code**:

```sql
dataset = xdr_data
| comp stddev_sample(action_network_bytes_received) as bytes_sample_stddev
```

**Explanation**: Without a `by` clause, the `stddev_sample()` function computes the sample standard deviation across all rows.

**Output**:

| BYTES\_SAMPLE\_STDDEV |
| --------------------- |
| 2678.91               |

### Example 3: Compare population and sample standard deviations

**Goal**: Compare population and sample standard deviations to understand the effect of Bessel's correction.

**XQL code**:

```sql
dataset = xdr_data
| comp stddev_sample(action_total_time) as sample_std, stddev_population(action_total_time) as pop_std, count(action_total_time) as n by agent_hostname
```

**Explanation**: This query computes both `stddev_sample()` and `stddev_population()` alongside the count, showing how the sample standard deviation is slightly larger due to Bessel's correction (dividing by N-1 instead of N).

**Output**:

| AGENT\_HOSTNAME | SAMPLE\_STD | POP\_STD | N |
| --------------- | ----------- | -------- | - |
| workstation-1   | 14.42       | 12.45    | 5 |
| workstation-2   | 9.62        | 8.32     | 4 |

## Related articles

* **Stages**: [`comp`](/xql-command-reference-guide/readme/stages/comp.md), [`fields`](/xql-command-reference-guide/readme/stages/fields.md), [`limit`](/xql-command-reference-guide/readme/stages/limit.md)
* **Functions**: [`stddev_population()`](/xql-command-reference-guide/readme/functions/stddev_population_with_comp_stage.md), [`stddev_sample (windowcomp)`](/xql-command-reference-guide/readme/functions/stddev_sample_with_windowcomp_stage.md), [`avg()`](/xql-command-reference-guide/readme/functions/avg_with_comp_stage.md), [`var()`](/xql-command-reference-guide/readme/functions/var.md)
* **Datasets**: [`xdr_data`](https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/stddev_sample_with_comp_stage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.