smooth Search Operator

The smooth operator calculates the rolling (or moving) average of a field, measuring the average of a value to "smooth" random variation. Smooth operator reveals trends in the data set you include in a query.

Within a query that contains a smooth operator you will choose a window (described as window_length in the syntax below); the average of the values within the window creates a data point.

If you specify a window length of 5, but only 4 data points are available, the smooth operator takes the average of whatever is available.

Adding a group by function to a smooth operator query produces a running average within each group (with data from each group calculated separately).

Syntax

smooth <field> [, <window length>] [as <field>]

Rules

• An alias for smooth is optional. When an alias is not provided, _smooth is the default alias.
• The specified field must contain numeric values.
• To add a query that includes a smooth operator to a Dashboard, you must add a group by function before the smooth operator.
• The default window length is 10.
• The maximum window length is 1000.

Example

The following examples use the sort operator to sort the time prior to calculating the rolling average with smooth.

Use smooth to see the difference of fields between time points, grouped by source host

Running a query such as:

_sourceCategory=katta
| timeslice by 1m
| count by _timeslice,_sourceHost
| sort + _timeslice
| smooth _count, 50 by _sourceHost

produces results like:

Smooth the difference of a quantity between time points

Using smooth with timeslice, you can run a query similar to:

* | parse "bytes transmitted: '*'" as bytes
| timeslice 1m
| sum(bytes) as bytes by _timeslice
| sort _timeslice
| smooth bytes, 5

that produces results like:

Use backshift with smooth and rollingstd to view the averages of incoming bytes

Running a query like:

...| timeslice by 1m
| avg(oneMinuteRate) as avgRateByHost by _sourceHost,_timeslice
| sum(avgratebyhost) as totalIncomingRate by _timeslice
| sort + _timeslice
| backshift totalIncomingRate, 1 as lagRate
| smooth lagRate,10 as movingAvg
| rollingstd lagRate,10 as rollingStd
| movingAvg + (3 * rollingStd) as upper
| movingAvg - (3 * rollingStd) as lower

produces results similar to:

Specify a window length of 5, but only 4 data points are available

Before 5 values are available, the smooth operator takes an average of whatever is available. For example:

_sourceCategory=katta
| timeslice by 1m
| count by _timeslice,_sourceHost
| where _sourceHost="nite-katta-cold-4"
| sort + _timeslice
| smooth _count,5

produces results like: