# Persist ESQL rows after applying AVG and STD\_DEV

**URL:** <https://discuss.elastic.co/t/persist-esql-rows-after-applying-avg-and-std-dev/377497>\
**Category:** Elasticsearch\
**Tags:** esql\
**Created:** [April 24, 2025, 5:01pm UTC](https://discuss.elastic.co/t/persist-esql-rows-after-applying-avg-and-std-dev/377497 "2025-04-24T17:01:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![O\_O\_O](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/o_o_o/32/141961_2.png) [@O\_O\_O](https://discuss.elastic.co/u/O_O_O)\
**Post date:** [April 24, 2025, 5:01pm UTC](https://discuss.elastic.co/t/persist-esql-rows-after-applying-avg-and-std-dev/377497/1 "2025-04-24T17:01:10Z")

</div>

If I need to calculate the standard deviation (STD\_DEV) for each row (using a number column from the row), how do I do that?

I currently have the snippet below:

```auto
FROM logs-*
| WHERE event.code == "4768" AND field1 == "value" AND NOT field2 LIKE "*$"
| STATS uniq_user = COUNT_DISTINCT(field2) BY field3
| EVAL comp_avg = AVG(uniq_user), comp_std = STD_DEV(uniq_user)

```

`uniq_user` has the values that I want use to calculate both `AVG` and `STD_DEV` for each row.  
Using `EVAL` to calculate `comp_avg = AVG(uniq_user), comp_std = STD_DEV(uniq_user)` returns:

> aggregate function [AVG(uniq\_user)] not allowed outside STATS command  
> aggregate function [STD\_DEV(uniq\_user)] not allowed outside STATS command

When I use `STATS` instead, I no longer have access to the previous rows, which contained `uniq_user` values.

Is there a way to calculate the `AVG` and `STD_DEV` and still have access to the previous rows containing `uniq_user`?

Thanks.