How does the moving average work?

[rosho]

Hi

How does the "moving average work"?
With "trendline" I am computing 5 and 10 events. But with "streamstats" I am computing the statistics of only 5 events.

I do not understand.

This is the SPL from the MLTK.

| inputlookup cyclical_business_process.csv
| trendline sma5(logons) as sma5_logons ema10(logons) as ema10_logons
| eval this_date_day = strftime(_time, "%w")
| eval this_date_hour = strftime(_time, "%H")
| eval this_date_day = strftime(_time, "%w")
| eval this_date_day = this_date_day."_"
| eval this_date_hour = this_date_hour."_"
| reverse
| streamstats current=f window=5 first(logons) as LogonsFromTheFuture
| reverse