Splunk Search

simple moving average

himpor
Engager

hi ,

i am analysing the daily data of product which has a closing price. i wish to find all products which has closing price greater than the moving average of lets say 5 days , 10 days. i am getting the correctly calculated sma but not in the desired row i.e. for 16th jan 18, DMA is calculated in 10th jan 18.

alt text

request you to please suggest the solution.

i wanted to show the product if the closing price is less than 5dma , in this case i.e. 16 jan 18, closing price is less than 5 DMA but the query is not showing the result.

alt text

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

View solution in original post

0 Karma

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...