| Table of Contents | ||||
|---|---|---|---|---|
|
...
How does it work in the search window?
| Note |
|---|
Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation. |
After grouping the data, select Aggregation in the search window toolbar, then select the Variance (unbiased) operation. You need to specify one argument:
Argument | Data type |
|---|---|
Unbiased variance of mandatory | integer, float |
The data type of the aggregated values is float.
...
In the siem.logtrust.web.activity table, we want to calculate the unbiased variance of the values found in the responseLength column during each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the Variance (unbiased) operation.
The arguments needed for the Variance (unbiased) operation are:
Unbiased variance of → responseLength column
...
Click Aggregate function and you will see the following result:
...