topic Is there a way we can calculate moving averages - Windows & x(t)? in Splunk Search

Is there a way we can calculate moving averages - Windows & x(t)?

anirban_td — Tue, 30 May 2023 04:02:46 GMT

Hello splunkers!

Is there is a way we can calculate moving/rolling averages such that the current data point, ```x(t)```, is somewhere in the middle of the window, rather than at the boundaries?
Ex: If ```window=5```, i want the MA to be calculated like:

MA = avg(x(t-2), x(t-1), x(t), x(t+1), x(t+2))

I am okay with using MLTK or any other method of implementing this.

---------------------------

For reference, in the following query, I show two similar methods of calculating MA - based on previous values of x(t)
here

MA = avg(x(t-4), x(t-3), x(t-2), x(t-1), x(t))

---------

PS: I am aware that in both methods, the absence of earlier/later values at the boundaries will cause the MA model to be inaccurate - I am okay to work around that.

Thanks in advance!

Re: Moving average - Windows & x(t)

ITWhisperer — Mon, 29 May 2023 22:19:23 GMT

What about something like this

Re: Is there a way we can calculate moving averages - Windows & x(t)?

Adnan — Fri, 26 Apr 2024 13:26:47 GMT

you can use the "windowstats" command to achieve your goal.

first download the windowstats app from here:

https://splunkbase.splunk.com/app/7329

your query | windowstats field=<field name> window=4 function=avg style=gradual

your query | windowstats field=<field name> window=4 function=avg style=dynamic

the difference between gradual and dynamic is how the window will be on the edges.

when t=0 (first element) and window size is 4 ( window=4 means 4 without counting the middle value (total window size will be 5)))

gradual will be

x(t), x(t+1), x(t+2), x(t+3), x(t+4)

dynamic will be:

x(t), x(t+1), x(t+2)

when t=size (last element) and window size is 4 ( window=4 means 4 without counting the middle value (total window size will be 5)))

gradual will be

x(t-4), x(t-3), x(t-2), x(t-1), x(t)

dynamic will be:

x(t-2), x(t-1), x(t)

both dynamic and gradual work in the same way in the middle values.

Happy Splunking!