Hi
How does the "moving average work"?
With "trendline" I am computing 5 and 10 events. But with "streamstats" I am computing the statistics of only 5 events.
I do not understand.
This is the SPL from the MLTK.
| inputlookup cyclical_business_process.csv
| trendline sma5(logons) as sma5_logons ema10(logons) as ema10_logons
| eval this_date_day = strftime(_time, "%w")
| eval this_date_hour = strftime(_time, "%H")
| eval this_date_day = strftime(_time, "%w")
| eval this_date_day = this_date_day."_"
| eval this_date_hour = this_date_hour."_"
| reverse
| streamstats current=f window=5 first(logons) as LogonsFromTheFuture
| reverse
