What is the difference between sma and avg?

[simona2121]

I want to know the exact difference between sma and avg. Also, can someone pls provide detailed description of trendline?

[jkat54 · Accepted solution]

index=_internal | timechart count | trendline sma5(count)

The number after sma is the number of buckets you want to average over.

So sma5(count) averages the last 5 occurrences of count, whereas avg(count) would only be the average number of count in that time bucket.

Say you have a field called sales, and these are your events:

8/8 - sales=100
8/8 - sales=50
8/8 - sales=100
8/8 - sales=50
8/9 - sales=200
8/9 - sales=100
8/9 - sales=200
8/9 - sales=100

The avg(sales) on 8/8 is 75, the avg(sales) on 8/9 is 150, the sma2(sales) is 112.5 on 8/9 but it wont even compute for 8/8 because you only have 1 day of trailing data with sales and you wanted sma2. AND this is assuming you put your data in buckets which equal 1 day of time each... if you add timestamps for hours, timechart would then change to different bucket sizes. You can force bucket sizes with the bin or bucket commands.

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Trendline
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Bin
bucket is alias of bin

[jkat54]

The simple moving average (SMA) is the most basic of the moving averages used for stock/futures trading usually. The simple moving average formula is calculated by taking the average closing price of a stock over the last "x" periods. (x@noon+x@1pm+x@2pm)/3

Average (AVG) is the sum of all the parts divided by the number of the parts (x+y+z)/3

[somesoni2]

The sma is available in trendline. Here is documentation on Trendline

https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Trendline