I am looking through the documentation on Splunk about trendlines and sma | ema | wma. In the documentation, it says you must pick an integer between 2 and 1000:
| trendline sma2(muffins) as trend
The documentation doesn't say what the period means, but you have to pick a number between 2 and 1000. I assuming "2" is one day, "3" is two days???
| makeresults count=100 | eval number = random() % 100 + 1 | streamstats count | fields count number | fields - _time | trendline sma2(number) sma5(number) sma10(number)
Hi, As you can see from the results, period is not limited to time.