Splunk Search

Trendline period integer syntax queston (sma | ema | wma)

UMDTERPS
Communicator

I am looking through the documentation on Splunk about trendlines and sma | ema | wma. In the documentation, it says you must pick an integer between 2 and 1000:

https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Trendline

| trendline sma2(muffins) as trend

The documentation doesn't say what the period means, but you have to pick a number between 2 and 1000. I assuming "2" is one day, "3" is two days???

0 Karma

to4kawa
Ultra Champion
| makeresults count=100
| eval number = random() % 100 + 1
| streamstats count
| fields count number
| fields - _time
| trendline sma2(number) sma5(number) sma10(number)

Hi, As you can see from the results, period is not limited to time.

0 Karma

russell120
Communicator

@to4kawa Could you explain what period is?

0 Karma

to4kawa
Ultra Champion

Moving average

Period means

the previous n data

UMDTERPS
Communicator

Ahh, I see. The Splunk documentation needs to be more clear.

0 Karma

russell120
Communicator

Oh I understand, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...