Splunk Search

simple moving average

himpor
Engager

hi ,

i am analysing the daily data of product which has a closing price. i wish to find all products which has closing price greater than the moving average of lets say 5 days , 10 days. i am getting the correctly calculated sma but not in the desired row i.e. for 16th jan 18, DMA is calculated in 10th jan 18.

alt text

request you to please suggest the solution.

i wanted to show the product if the closing price is less than 5dma , in this case i.e. 16 jan 18, closing price is less than 5 DMA but the query is not showing the result.

alt text

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

View solution in original post

0 Karma

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...