Splunk Search

simple moving average

himpor
Engager

hi ,

i am analysing the daily data of product which has a closing price. i wish to find all products which has closing price greater than the moving average of lets say 5 days , 10 days. i am getting the correctly calculated sma but not in the desired row i.e. for 16th jan 18, DMA is calculated in 10th jan 18.

alt text

request you to please suggest the solution.

i wanted to show the product if the closing price is less than 5dma , in this case i.e. 16 jan 18, closing price is less than 5 DMA but the query is not showing the result.

alt text

Tags (1)
0 Karma
1 Solution

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

View solution in original post

0 Karma

elliotproebstel
Champion

I believe the issue is that Splunk is calculating the sma in reverse-chronological order, because this is the ordering of the results. If you replace your command | sort -Date with | sort Date, calculate your averages, and then put things back in your desired ordering by adding |sort -Date after the calculations - this should get you the actual averages you are seeking.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...