Rolling Averages

[justx001]

I am having alot of trouble setting up rolling averages in Splunk. I would love to be able to overlay a 30, 60, 90 day trend line over my current trend line. this seems like a pretty standard function in analysis so I am sure im over looking some simple function? Is there documentation or guidance on how to set up rolling averages?

[justx001]

Thank you very much for the quick reply, the reference and the example

[skoelpin · Accepted solution]

You'll want to use streamstats to accomplish this

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Streamstats

Try something like this

<your base search> | timechart count span=30d | streamstats window=20 avg(count) as avgCount | fields _time avgCount [search <your base search> | timechart count span=60d | streamstats window=20 avg(count) as avgCount | fields _time avgCount]

[aljohnson_splun]

As an addendum to this fabulous answer, @justx001 you might want to check out the trendline command as well, it has weighted and exponential moving averages as well.


| ... base search
| timechart count span=1d
| trendline sma10(count) as ten_day_simple_moving_average, wma30(count) as month_weighted_moving_average, ema7(count) as week_exponential_moving_average


[cmerriman]

use |streamstats

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Streamstats

it's great for rolling averages. you can do multiple streamstats, one for the 30, 60, and 90 day windows.