topic Re: Trendline period integer syntax queston (sma | ema | wma) in Splunk Search

Trendline period integer syntax queston (sma | ema | wma)

UMDTERPS — Wed, 23 Oct 2019 13:09:22 GMT

I am looking through the documentation on Splunk about trendlines and sma | ema | wma. In the documentation, it says you must pick an integer between 2 and 1000:

https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Trendline

| trendline sma2(muffins) as trend

The documentation doesn't say what the period means, but you have to pick a number between 2 and 1000. I assuming "2" is one day, "3" is two days???

Re: Trendline period integer syntax queston (sma | ema | wma)

to4kawa — Wed, 23 Oct 2019 13:42:20 GMT

| makeresults count=100
| eval number = random() % 100 + 1
| streamstats count
| fields count number
| fields - _time
| trendline sma2(number) sma5(number) sma10(number)

Hi, As you can see from the results, period is not limited to time.

Re: Trendline period integer syntax queston (sma | ema | wma)

russell120 — Wed, 23 Oct 2019 13:54:01 GMT

@to4kawa Could you explain what period is?

Re: Trendline period integer syntax queston (sma | ema | wma)

to4kawa — Wed, 23 Oct 2019 14:12:34 GMT

Moving average

Period means

the previous n data

Re: Trendline period integer syntax queston (sma | ema | wma)

russell120 — Wed, 23 Oct 2019 17:08:34 GMT

Oh I understand, thanks!

Re: Trendline period integer syntax queston (sma | ema | wma)

UMDTERPS — Wed, 23 Oct 2019 17:15:40 GMT

Ahh, I see. The Splunk documentation needs to be more clear.