This page explains how to use the varianceif aggregation function in APL.
varianceif
aggregation in APL calculates the variance of values that meet a specified condition. This is useful when you want to understand the variability of a subset of data without considering all data points. For example, you can use varianceif
to compute the variance of request durations for HTTP requests that resulted in a specific status code or to track anomalies in trace durations for a particular service.
You can use the varianceif
aggregation when analyzing logs, telemetry data, or security events where conditions on subsets of the data are critical to your analysis.
Splunk SPL users
eval
function to filter data and calculate variance for specific conditions. In APL, varianceif
combines the filtering and aggregation into a single function, making your queries more concise.ANSI SQL users
CASE
statement to apply conditional logic and then compute the variance. In APL, varianceif
simplifies this by combining both the condition and the aggregation.Expr
: The expression (numeric) for which you want to calculate the variance.Predicate
: A boolean condition that determines which records to include in the calculation.Expr
for the records where the Predicate
is true. If no records match the condition, it returns null
.
varianceif
function to calculate the variance of HTTP request durations for requests that succeeded (status == '200'
).Queryvarianceif_req_duration_ms |
---|
15.6 |
avgif
when you want the average instead of variance.sumif
when you’re interested in totals, not variance.stdevif
when you want to measure dispersion using standard deviation instead of variance.