topic Re: How to use predict command in tabular format? in Splunk Search

How to use predict command in tabular format?

Taruchit — Wed, 18 Oct 2023 19:28:39 GMT

Hello All,

I have data in the form of a table with two fields: index, sourcetype. Each row has unique pair of values for the two fields.

I need your guidance to compute and publish the forecast value for number of events next day based on historical data fetched for each row on the basis of corresponding index and sourcetype.

Any inputs and guidance will be very helpful.

Thank you
Taruchit

Re: How to use predict command in tabular format?

isoutamo — Thu, 19 Oct 2023 07:47:52 GMT

predict needs a time series data for make a forecast. Also it needs enough datapoints to do that forecast.

Based on your need you should/could select user algorithm and other needed parameters or use just predict with field lists like

index=_internal source=*/var/log/splunk/*.log | timechart count by sourcetype | fields splunkd splunkd_access | predict splunkd splunkd_access

Could you share your current data (inside "</>" block)?

r. Ismo

Re: How to use predict command in tabular format?

Taruchit — Thu, 19 Oct 2023 11:02:44 GMT

Hello @isoutamo,

The data is in the lookup file is in the form below, I need to read data from each row and compute the results: -

index sourcetype ----------------------- idx1 s1 idx2 s2 idx3 s3 idx1 s4

Now I need to compute and display results of each row by running predict command on each of them.

The base query that I have built for running predict command that will fetch the forecast values for each row: -

index=custom_index orig_index=idx1 orig_sourcetype=s1 earliest=-4w@w latest=-2d@d | timechart span=1d avg(event_count) AS avg_event_count | predict avg_event_count | tail 1 | fields prediction(avg_event_count)

Please share if you need any more details from my end. I hope to seek your inputs on solving the problem.

Thank you

Re: How to use predict command in tabular format?

isoutamo — Thu, 19 Oct 2023 11:57:52 GMT

How many (approximately) index sourcetype pairs you have? Only those few or e.g. tens/hundreds?

Re: How to use predict command in tabular format?

Taruchit — Thu, 19 Oct 2023 12:03:45 GMT

Hi @isoutamo,

The current count is under 150.

Thank you

Re: How to use predict command in tabular format?

isoutamo — Fri, 01 Dec 2023 08:45:50 GMT

As long as you have only some pairs you could try map command https://docs.splunk.com/Documentation/Splunk/9.1.2/SearchReference/Map

But you must follow up it's memory and other resource usage and when needed switch to other way to do it.