varianceif ​

The varianceif aggregation function calculates the variance of Expression for which Predicate evaluates to true.

Use this function with the summarize, eventstats, and timestats operators.

Syntax ​

varianceif( Expression, Predicate )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
• Predicate: Predicate that if true, the Expression calculated value will be added to the variance.

Results ​

Returns the variance value of Expression across the group for which Predicate evaluates to true.

Example ​

This example summarizes the variance in byte count, by source address, for events whose destinatino port is higher than 1024:

dataset="cribl_search_sample" dataSource="vpcflowlogs" 
| summarize varianceif(bytes, dstport>1024) by srcaddr