hi, I had the data in the following format location product price location1 Product1 price1 location1 product2 price2 location2 product1 price3 location2 product2 price4 I need to re-align it in following format location product1 product2 location1 price1 price2 location2 price3 price4 I can do it by splitting column by data model or pivot from base query. but is there any way for the using the SPL the following can be achieved. ... View more

hi , i had the following data which is collected daily price of 50 itesms i.e. TIMESTAMP, CLOSE and SYMBOL ( eg. 31-jan-2018, PRD1, 320 01-Feb-2018, PRD1, 330 31-jan-2018, PRD2, 1500 01-Feb-2018, PRD1, 1520 ). i need to find all the product whose closing price is lets say greater than 10 day moving average, 30 day moving average etc. ) this query i am writing input data | fields SYMBOL, TIMESTAMP,CLOSE | eval Date =strptime(TIMESTAMP, "%d-%b-%Y") | fieldformat Date=strftime(Date, "%d-%b-%Y") | sort Date | trendline sma10(CLOSE) as DMA10 | trendline sma30(CLOSE) as DMA30 | table Date, SYMBOL, CLOSE, DMA10, DMA30 | sort -Date however this query works well if i write for any one product but calculation fails when data is for both product and sma moving average is also incorrectly calculated Please suggest the approach ... View more

hi , i am analysing the daily data of product which has a closing price. i wish to find all products which has closing price greater than the moving average of lets say 5 days , 10 days. i am getting the correctly calculated sma but not in the desired row i.e. for 16th jan 18, DMA is calculated in 10th jan 18. request you to please suggest the solution. i wanted to show the product if the closing price is less than 5dma , in this case i.e. 16 jan 18, closing price is less than 5 DMA but the query is not showing the result. ... View more

Hi Everyone, I need a suggestion to build the Splunk app or query . The situation is I had list of cities (lets say around 1800 odd cities) ( source type lets say india) The cities are classified in multiple groups in separate CSV which will be used for lookup statewise (i.e. cities clubed according to region) around 28 files ( lets say punjab.csv which has list of all cities of punjab) region wise ( east, west, north , south etc.) i.e. list of cities clubbed together as region I need to perform queries to identify patterns for statewise, regionwise which requires the filtering of larger set i.e. india data in smaller subset i.e. region or state is it advisable to create the eventtype for each state like punjab, haryana etc. and north, south etc. or use the macro to filter the events. to achieve performance, or possibility of creating datamodels if required. ... View more