mad

Return the Median Absolute Deviation (MAD) of the value of the specified field.

put|reduce mad(field)

Parameter	Description	Required?
field	The field to compute	Yes

Median Absolute Deviation (MAD) is related to standard deviation in much the way that median is related to mean. It is a robust measure of how spread out a set of values are around their central location (the median). MAD = median( | x - median| )

Example: MAD and standard deviations

The example below shows how MAD and standard deviation behave on samples from a pure normal distribution and samples from a distribution "contaminated" with an outlier distribution (1% contamination). The MAD estimate for the contaminated distribution remains close to its value for the dominant (pure) distribution, unlike the standard deviation.

This example uses a module from the standard library.

import "random.juttle" as random;
emit -limit 1000 -from Date.new(0)
| put pure = random.normal(0, 1)
| put mixed = (Math.random() < .99) ? random.normal(0, 1) : random.normal(100, 0.1)
| reduce
   pure_mean = avg(pure),
   pure_median = percentile(pure, 0.5),
   pure_sd = stdev(pure),
   pure_mad = mad(pure) * 1.48, // the 1.48 factor scales normal MAD to be same as normal SD
   mixed_mean = avg(mixed),
   mixed_median = percentile(mixed, 0.5),
   mixed_sd = stdev(mixed),
   mixed_mad = mad(mixed) * 1.48
| view table -columnOrder ['pure_mean', 'pure_sd', 'pure_median', 'pure_mad', 'mixed_mean', 'mixed_sd', 'mixed_median', 'mixed_mad']