Is there a way we can calculate moving averages - Windows & x(t)?

[anirban_td]

Hello splunkers!

Is there is a way we can calculate moving/rolling averages such that the current data point, ```x(t)```, is somewhere in the middle of the window, rather than at the boundaries? 
Ex: If ```window=5```, i want the MA to be calculated like: 

MA = avg(x(t-2), x(t-1), x(t), x(t+1), x(t+2))

I am okay with using MLTK or any other method of implementing this. 

---------------------------

For reference, in the following query, I show two similar methods of calculating MA - based on previous values of x(t)
here  

MA = avg(x(t-4), x(t-3), x(t-2), x(t-1), x(t))

| makeresults count=100
| streamstats count as s
| eval n=(random() % 100000) + 1
| table s n
| streamstats window=5 avg(n) as trend
| autoregress n p=1-5
| fillnull value=0
| eval ma = avg(n, n_p1, n_p2, n_p3, n_p4)
| fields s n ma trend

---------

PS: I am aware that in both methods, the absence of earlier/later values at the boundaries will cause the MA model to be inaccurate - I am okay to work around that. 

Thanks in advance!

[Adnan]

you can use the "windowstats" command to achieve your goal.

first download the windowstats app from here:

https://splunkbase.splunk.com/app/7329

 your query | windowstats field=<field name> window=4 function=avg style=gradual

 OR

 your query | windowstats field=<field name> window=4 function=avg style=dynamic

the difference between gradual and dynamic is how the window will be on the edges.

when t=0 (first element) and window size is 4 ( window=4 means 4 without counting the middle value (total window size will be 5)))

gradual will be 

 x(t), x(t+1), x(t+2), x(t+3), x(t+4)

dynamic will be:

 x(t), x(t+1), x(t+2)

when t=size (last element) and window size is 4 ( window=4 means 4 without counting the middle value (total window size will be 5)))

gradual will be 

x(t-4),  x(t-3),  x(t-2), x(t-1), x(t)

dynamic will be:

 x(t-2), x(t-1), x(t)

both dynamic and gradual work in the same way in the middle values. 

Happy Splunking! 

[ITWhisperer]

What about something like this

| makeresults count=100
| streamstats count as s
| eval n=(random() % 100000) + 1
| table s n
| streamstats window=5 avg(n) as trend
| reverse
| autoregress trend p=2 as ra
| reverse
| fillnull value=0