simple moving average

[himpor]

hi ,

i am analysing the daily data of product which has a closing price. i wish to find all products which has closing price greater than the moving average of lets say 5 days , 10 days. i am getting the correctly calculated sma but not in the desired row i.e. for 16th jan 18, DMA is calculated in 10th jan 18.

request you to please suggest the solution.

i wanted to show the product if the closing price is less than 5dma , in this case i.e. 16 jan 18, closing price is less than 5 DMA but the query is not showing the result.

[elliotproebstel · Accepted solution]

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.