stdev

The stdev aggregation in APL computes the standard deviation of a numeric field within a dataset. This is useful for understanding the variability or dispersion of data points around the mean. You can apply this aggregation to various use cases, such as performance monitoring, anomaly detection, and statistical analysis of logs and traces.

Use the stdev function to determine how spread out values like request duration, span duration, or response times are. This is particularly helpful when analyzing data trends and identifying inconsistencies, outliers, or abnormal behavior.

​

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​

Usage

​

Syntax

stdev(numeric_field)

​

Parameters

• numeric_field: The field containing numeric values for which the standard deviation is calculated.

​

Returns

The stdev aggregation returns a single numeric value representing the standard deviation of the specified numeric field in the dataset.

​

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

['sample-http-logs']
| summarize req_duration_std = stdev(req_duration_ms)

​

List of related aggregations

• avg: Calculates the average value of a numeric field. Use avg to understand the central tendency of the data.
• min: Returns the smallest value in a numeric field. Use min when you need to find the minimum value.
• max: Returns the largest value in a numeric field. Use max to identify the peak value in a dataset.
• sum: Adds up all the values in a numeric field. Use sum to get a total across records.
• count: Returns the number of records in a dataset. Use count when you need the number of occurrences or entries.