Splunk Search

simple moving average with two variables

himpor
Engager

hi ,
i had the following data which is collected daily price of 50 itesms i.e. TIMESTAMP, CLOSE and SYMBOL
( eg. 31-jan-2018, PRD1, 320
01-Feb-2018, PRD1, 330
31-jan-2018, PRD2, 1500
01-Feb-2018, PRD1, 1520

).

i need to find all the product whose closing price is lets say greater than 10 day moving average, 30 day moving average etc. )

this query i am writing

input data
| fields SYMBOL, TIMESTAMP,CLOSE
| eval Date =strptime(TIMESTAMP, "%d-%b-%Y")
| fieldformat Date=strftime(Date, "%d-%b-%Y")
| sort Date
| trendline sma10(CLOSE) as DMA10
| trendline sma30(CLOSE) as DMA30
| table Date, SYMBOL, CLOSE, DMA10, DMA30
| sort -Date

however this query works well if i write for any one product but calculation fails when data is for both product and sma moving average is also incorrectly calculated

Please suggest the approach

Tags (1)
0 Karma
1 Solution

Sukisen1981
Champion

SYMBOL is your product, right?
Instead of | table Date, SYMBOL, CLOSE, DMA10, DMA30 try stats values(Date),values(CLOSE),values(DMA10),values(DMA30) by SYMBOL

View solution in original post

0 Karma

acharlieh
Influencer

As you're looking for a simple moving average with a window, instead of the trendline command, what about using the streamstats command ?

You can set the window / time window appropriately, and just have average(close) by symbol

0 Karma

Sukisen1981
Champion

SYMBOL is your product, right?
Instead of | table Date, SYMBOL, CLOSE, DMA10, DMA30 try stats values(Date),values(CLOSE),values(DMA10),values(DMA30) by SYMBOL

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...