Splunk Search

simple moving average with two variables

himpor
Engager

hi ,
i had the following data which is collected daily price of 50 itesms i.e. TIMESTAMP, CLOSE and SYMBOL
( eg. 31-jan-2018, PRD1, 320
01-Feb-2018, PRD1, 330
31-jan-2018, PRD2, 1500
01-Feb-2018, PRD1, 1520

).

i need to find all the product whose closing price is lets say greater than 10 day moving average, 30 day moving average etc. )

this query i am writing

input data
| fields SYMBOL, TIMESTAMP,CLOSE
| eval Date =strptime(TIMESTAMP, "%d-%b-%Y")
| fieldformat Date=strftime(Date, "%d-%b-%Y")
| sort Date
| trendline sma10(CLOSE) as DMA10
| trendline sma30(CLOSE) as DMA30
| table Date, SYMBOL, CLOSE, DMA10, DMA30
| sort -Date

however this query works well if i write for any one product but calculation fails when data is for both product and sma moving average is also incorrectly calculated

Please suggest the approach

Tags (1)
0 Karma
1 Solution

Sukisen1981
Champion

SYMBOL is your product, right?
Instead of | table Date, SYMBOL, CLOSE, DMA10, DMA30 try stats values(Date),values(CLOSE),values(DMA10),values(DMA30) by SYMBOL

View solution in original post

0 Karma

acharlieh
Influencer

As you're looking for a simple moving average with a window, instead of the trendline command, what about using the streamstats command ?

You can set the window / time window appropriately, and just have average(close) by symbol

0 Karma

Sukisen1981
Champion

SYMBOL is your product, right?
Instead of | table Date, SYMBOL, CLOSE, DMA10, DMA30 try stats values(Date),values(CLOSE),values(DMA10),values(DMA30) by SYMBOL

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...