trendline
trendline
Synopsis
Computes the moving averages of fields.
Syntax
trendline <trendtype><period>(<field>) [AS <newfield>]
Required arguments
- trendtype
- Syntax: syntax = sma|ema|wma
- Description: The type of trend to compute. Current supported trend types include simple moving average (sma), exponential moving average (ema), and weighted moving average (wma).
- period
- Syntax: <num>
- Description: The period over which to compute the trend, an integer between 2 and 10000.
- <field>
- Syntax: <field>
- Description: The name of the field on which to calculate the trend.
Optional arguments
- <newfield>
- Syntax: <field>
- Description: Specify a new field name to write the output to. Defaults to <trendtype><period>(<field>).
Description
Computes the moving averages of fields: simple moving average (sma), exponential moving average(ema), and weighted moving average(wma) The output is written to a new field, which you can specify.
Examples
Example 1: Computes a five event simple moving average for field 'foo' and write to new field 'smoothed_foo.' Also, in the same line, computes ten event exponential moving average for field 'bar' and write to field 'ema10(bar)'.
... | trendline sma5(foo) as smoothed_foo ema10(bar)See also
accum, autoregress, delta, streamstats
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the trendline command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.
Can the trendline be included in an existing chart? I'd like to be able to plot the trandline over a series of raw data points.