Logic Behind Sigma Function | TICKScript

[Mert]

Hi, I wanted to create an alert based on ‘response_time’ variable which is coming from telegraf http_response input plugin.

So, the aim here is to trigger an alert when the response_time value is 3 sigma away from the mean.

...data stream...
|window
  period(10m)
  every(1m)
|mean('response_time')
    .as('mean')
|eval(lambda: sigma("mean"))
    .as('sigma')
    .keep()

Yet, I am not sure if I understand completely how the above code works. Please, correct if I’m wrong.
It takes data in a 10m period. So, we have sample, with N number of data point. Takes the mean of that N data point. It returns 1 value, right? The mean.

Then how does it calculate the sigma with 1 mean? Does it keeping consecutive results in the background and update sigma?

This is was my first question.

The second questions is how different is the above code from using sigma function directly over the value without mean and window function.

|eval(lambda: sigma("response_time"))

How far does this function goes for calculating mean and stddev assuming it needs stddev and mean for the sigma result?

Thanks,

[Mert]

Up. Up. Up.

is it legal to move your post up? =p

[Anaisdg]

Hello @Mert,

1. Based on this issue #978, I believe you’re right–it keeps consecutive results in the background and updates sigma.
   You might find this post useful too.
2. I believe that the difference between the latter and the former, is that that the former would calculate 3 standard deviations away from the mean of the mean of your data whereas the latter would just calculate 3 standard deviations away from the mean of your data.