stddev

The stddev function returns the standard deviation over all the possible values.

Syntax	Param data types	Return type
stddev(numericExpression)	NUMBER	NUMBER

Code Sample

• Find all the events where target.ip is not empty. For all the events that match on principal.ip, store the standard deviation of metadata.event_timestamp.seconds in a variable called stddev_seconds.

  target.ip != ""
  match:
    principal.ip
  outcome:
    $stddev_seconds = stddev(metadata.event_timestamp.seconds)