Sigma Stateful function should have rolling window period

[nathanielc]

The stateful sigma function is useful in that it computes deviations from the norm easily, but currently it doesn't support limiting the window that it tracks. Meaning it computes the moving mean and stddev for all points seen forever. For it to be more useful, older values need to be forgotten via a moving window. Essentially this should look like the moving_average function but with the sigma pieces added on.

[austinbutler]

Is this still planned?

[rubycut]

Yes, this is important, I am reluctant to even use sigma, since it seems that it is tracking data since task was created.

[patrickvallet]

Hi, I am trying to calculate sigma value manually but I a quite far from my alert value. What is the formula use? Is it realy the standard deviation forumula? There's no details about that in any document. If it's really comutes deviations for all points seen forever, that is not very nice in my opinion also.

[scottwilson312]

The running mean of a defined window seems much more useful than the running mean of the entire history

[ashishkaransingh]

Thank you @nathanielc for providing confirmation. In the mean time we can use stddev as the following which will calculate standard deviation correctly using windows.

|window()
.period(5m)
.every(5m)
|where(lambda: isPresent("Percent_Processor_Time"))
|eval(lambda: "Percent_Processor_Time")
  .as('Percent_Processor_Time')
|stddev('Percent_Processor_Time')
  .as('StdDev_1_Percent_Processor_Time')

[gabzim]

I thought this was the implemented behavior, a bit surprised to find it's not. I guess this is not going to be addressed?