autoregress
autoregress
Synopsis
Sets up data for calculating the moving average.
Syntax
autoregress field [AS <newfield>] [p=<p_start>[-<p_end>]]
Required arguments
- field-list
- Syntax: <field>...
- Description: One or more numeric fields, delimited with a space, and can not include wildcards.
Optional arguments
- p
- Syntax: p=<int:p_start>
- Description: If 'p' option is unspecified, it is equivalent to p_start = p_end = 1 (i.e., copy only the previous one value of field into field_p1
- newfield
- Syntax: <field>
- Description: note that p cannot be a range if newfield is specified.
- p_start
- Syntax: <int>
- Description: If 'p' option is unspecified, it is equivalent to p_start = p_end = 1 (i.e., copy only the previous one value of field into field_p1
- p_end
- Syntax: <int>
- Description: If 'p' option is unspecified, it is equivalent to p_start = p_end = 1 (i.e., copy only the previous one value of field into field_p1
Description
Sets up data for auto-regression (moving average) by copying the p-th previous values for field into each event as newfield (or if unspecified, new fields field_pp-val for p-val = p_start-p_end). If 'p' option is unspecified, it is equivalent to p_start = p_end = 1 (i.e., copy only the previous one value of field into field_p1. Note that p cannot be a range if newfield is specified.
Examples
Example 1: For each event, copy the 3rd previous value of the 'foo' field into the field 'oldfoo'.
... | autoregress foo AS oldfoo p=3Example 2: For each event, copy the 2nd, 3rd, 4th, and 5th previous values of the 'count' field into the respective fields 'count_p2', 'count_p3', 'count_p4', and 'count_p5'.
... | autoregress count p=2-5See also
accum, delta, streamstats, trendline
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the autoregress command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.