Is your feature request related to a problem?
A simple self contained way to get the PPL grammar description and usage example, this would also allow new users to get basic understanding of the language and its functionality
What solution would you like?
The next example reviews the trendline command:
>> help trendline
DESCRIPTION
Computes moving averages of fields: simple moving average (SMA) and weighted moving average (WMA). The output is written to a new field.
SYNTAX
trendline <trendtype>(<period>, <field>) [AS <newfield>] [, ...]
ARGUMENTS
trendtype (Required) The type of trend to compute. Supported types:
sma: Simple Moving Average
wma: Weighted Moving Average
period (Required) An integer between 2 and 10000 representing the period over which to compute the trend.
field (Required) The name of the field on which to calculate the trend.
newfield (Optional) The name of the new field to store the result. If not specified, defaults to <trendtype><period>(<field>).
USAGE EXAMPLE
source=cpu_metrics
| where host='webserver01'
| trendline sma(5, cpu_usage) AS smooth_cpu, wma(10, memory_usage) AS mem_trend
| stats avg(smooth_cpu), max(mem_trend) by date_histogram(timestamp, '1h')
Is your feature request related to a problem? A simple self contained way to get the PPL grammar description and usage example, this would also allow new users to get basic understanding of the language and its functionality
What solution would you like? The next example reviews the
trendline
command: