Hi, I wanted to create an alert based on ‘response_time’ variable which is coming from telegraf http_response input plugin.

So, the aim here is to trigger an alert when the response_time value is 3 sigma away from the mean.

```
...data stream...
|window
period(10m)
every(1m)
|mean('response_time')
.as('mean')
|eval(lambda: sigma("mean"))
.as('sigma')
.keep()
```

Yet, I am not sure if I understand completely how the above code works. Please, correct if I’m wrong.

It takes data in a 10m period. So, we have sample, with N number of data point. Takes the mean of that N data point. It returns 1 value, right? The mean.

Then how does it calculate the sigma with 1 mean? Does it keeping consecutive results in the background and update sigma?

This is was my first question.

The second questions is how different is the above code from using sigma function directly over the value without mean and window function.

```
|eval(lambda: sigma("response_time"))
```

How far does this function goes for calculating mean and stddev assuming it needs stddev and mean for the sigma result?

Thanks,