Splunk Search

How do I get cumulative moving average?

brdennehy
Explorer

Hi guys,

I am trying to compute and chart the cumulative moving average (ref. of what is it:https://en.wikipedia.org/wiki/Moving_average#Cumulative_moving_average)

The point is that I am doing the following query:

host=SARITA source="login.csv" | reverse | accum elapsed_time as cumulative_elapsed_time | timechart span=5h last(cumulative_elapsed_time) by server

And what I get from it is the cumulative sum. Now what I still need is to get cumulative count (which means, for any "n" value, to get the amount n up to that point in time, but not the total amount of values of all that series), so I can divide the cumulative value by the cumulative count, thus having the cumulative average.

Please help me with this, as I am really stuck on it. Thank you very much in advance for your patience.

Best regards,
Brian

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use the streamstats command to count the events.

host=SARITA source="login.csv" 
| reverse 
| streamstats count 
| accum elapsed_time as cumulative_elapsed_time 
| timechart span=5h last(cumulative_elapsed_time) by server

Even better would be to let streamstats do the moving average for you.

host=SARITA source="login.csv" 
| reverse 
| streamstats time_window=5h avg(elapsed_time) as AvgElapsedTime by server
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the streamstats command to count the events.

host=SARITA source="login.csv" 
| reverse 
| streamstats count 
| accum elapsed_time as cumulative_elapsed_time 
| timechart span=5h last(cumulative_elapsed_time) by server

Even better would be to let streamstats do the moving average for you.

host=SARITA source="login.csv" 
| reverse 
| streamstats time_window=5h avg(elapsed_time) as AvgElapsedTime by server
---
If this reply helps you, Karma would be appreciated.

brdennehy
Explorer

Thanks!! I'll try the streamstats tomorrow.

The problem with your suggestion of making streamstats to do the moving average for me is that the time window must be from the first measure until that point n in question, and not 5h....

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I chose the time_window option based on your use of timechart span=5h, but you can use another option that works better for your use case.

---
If this reply helps you, Karma would be appreciated.
0 Karma

brdennehy
Explorer

Thanks man! I used the default (non specified) time-frame. I read that the limit is 10,000 events, but it's ok. I only have 2 events per day.

Thank you very much!!!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...