topic Re: Splunk Predict - Is it possible to forecast future data (not from the last data point) using past data? in Knowledge Management

Splunk Predict - Is it possible to forecast future data (not from the last data point) using past data?

arielpconsolaci — Wed, 05 Apr 2017 01:36:58 GMT

I have created a panel that predicts future ticket volume given past values over time as shown below. From this panel created, it can be observed that Splunk shows its future predictions (March 1 onwards) from the last data point (February 28).

Is it possible for Splunk to predict future data not starting from the last data point selected?
Example would be forecasting data for the month of April 2017 considering only the volumes of April from the previous years (e.g. April 2015, April 2016).

Hoping someone could confirm. Responses are highly appreciated. Thank you.

Re: Splunk Predict - Is it possible to forecast future data (not from the last data point) using past data?

sduff_splunk — Wed, 05 Apr 2017 02:07:32 GMT

Using the predict command, you can specify the hold back option to specify how many values before the end to start the prediction from..

However, you are asking something a little different, predicting based on each month's volumes. In this case, I would modify the splunk search to remove all the non-required months (everything except April) and base my prediction on this.

Personally, I don't think this would produce great results. If you have a large volume of ticket in May, for example, it is likely that April may get a little bit of a bump as well. If you remove all other months, you're probably going to miss that influence.

Re: Splunk Predict - Is it possible to forecast future data (not from the last data point) using past data?

arielpconsolaci — Mon, 17 Apr 2017 06:44:21 GMT

Thank you for your response, sduff. Much appreciated. I got your points including that the results won't make much sense since it will be bypassing data from other or succeeding months. Furthermore, more data points will produce a more efficient predictability. However, I will still have to deliver that function.

I just did it as you advised (modified search to remove non-required months - Selected months of February only for 2016 and 2017l). The results show predictions monthly as well from the last data point/month (from February - Thus, March, April, and so on). Can i modify this to show only prediction for months of February (Feb 2018, Feb 2019) only as well?

Thanks in advance again.

Re: Splunk Predict - Is it possible to forecast future data (not from the last data point) using past data?

RemcoKas — Mon, 17 Apr 2017 09:31:46 GMT

Hello Ariel,
delivering the function / functionality won't be a problem with the predict command or maybe even the ML app.
The question would be if the predication has any value.

Do you have some more background info on the ticket data? (eg. are these changes or incidents, have there been changes in the infrastructure or services during the past years etc.)