topic Re: Rolling Averages in Splunk Search

Rolling Averages

justx001 — Fri, 14 Oct 2016 12:42:12 GMT

I am having alot of trouble setting up rolling averages in Splunk. I would love to be able to overlay a 30, 60, 90 day trend line over my current trend line. this seems like a pretty standard function in analysis so I am sure im over looking some simple function? Is there documentation or guidance on how to set up rolling averages?

Re: Rolling Averages

cmerriman — Fri, 14 Oct 2016 12:48:24 GMT

use |streamstats

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Streamstats

it's great for rolling averages. you can do multiple streamstats, one for the 30, 60, and 90 day windows.

Re: Rolling Averages

skoelpin — Fri, 14 Oct 2016 13:05:34 GMT

You'll want to use streamstats to accomplish this

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Streamstats

Try something like this

Re: Rolling Averages

justx001 — Fri, 14 Oct 2016 13:35:56 GMT

Thank you very much for the quick reply, the reference and the example

Re: Rolling Averages

aljohnson_splun — Fri, 14 Oct 2016 18:44:47 GMT

As an addendum to this fabulous answer, @justx001 you might want to check out the trendline command as well, it has weighted and exponential moving averages as well.

| ... base search | timechart count span=1d | trendline sma10(count) as ten_day_simple_moving_average, wma30(count) as month_weighted_moving_average, ema7(count) as week_exponential_moving_average