https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411616#M50226 <P>I have the same problem/requirement.<BR /> What I want to do is to have predictions for counts of events in the timechart that is split by country, using trellis chart. Is there a way? The normal BY clause doesn't output anything when adding PREDICT</P> Mon, 15 Oct 2018 12:15:25 GMT mraudaschl 2018-10-15T12:15:25Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411611#M50221 <P>Is there a way to split by using predict.</P> <P>I can predict on a single factor, e.g. </P> <PRE><CODE>| timechart span=1h max(values) as values | predict values </CODE></PRE> <P>How about: </P> <PRE><CODE>| timechart span=1h max(values) as values by user? </CODE></PRE> Fri, 17 Aug 2018 17:37:32 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411611#M50221 the_wolverine 2018-08-17T17:37:32Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411612#M50222 <P>saw a nice answer by @kmorris_splunk on this subject but couldnt find it now. maybe he will see my ping and will be able to locate it better</P> Fri, 17 Aug 2018 19:05:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411612#M50222 adonio 2018-08-17T19:05:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411613#M50223 <P>Here it is: <A href="https://answers.splunk.com/answers/661506/predict-with-wildcard.html#answer-661742">https://answers.splunk.com/answers/661506/predict-with-wildcard.html#answer-661742</A></P> <P>This was a slightly different scenario, but it may be helpful.</P> Sat, 18 Aug 2018 04:03:17 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411613#M50223 kmorris_splunk 2018-08-18T04:03:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411614#M50224 <P>Thanks but the example did not support an actual by-clause</P> <P>index=_internal sourcetype=splunkd* <BR /> | stats count by sourcetype <BR /> | map search="search index=_internal sourcetype=$sourcetype$ | timechart count as $sourcetype$ | predict $sourcetype$" <BR /> | stats values(*) as * by _time</P> <P>I need predict to support "timechart count as $sourcetype$ by host" for example.</P> Tue, 29 Sep 2020 20:59:19 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411614#M50224 the_wolverine 2020-09-29T20:59:19Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411615#M50225 <P>What is your exact use case here? What are you trying to predict? </P> <P>It's possible your climbing the wrong ladder here</P> Mon, 27 Aug 2018 16:18:03 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411615#M50225 skoelpin 2018-08-27T16:18:03Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411616#M50226 <P>I have the same problem/requirement.<BR /> What I want to do is to have predictions for counts of events in the timechart that is split by country, using trellis chart. Is there a way? The normal BY clause doesn't output anything when adding PREDICT</P> Mon, 15 Oct 2018 12:15:25 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Can-you-use-predict-with-split-by-function/m-p/411616#M50226 mraudaschl 2018-10-15T12:15:25Z