topic Re: predict does not span the full dataset in Splunk Search

predict does not span the full dataset

kenvanderheyden — Mon, 28 Sep 2020 18:30:38 GMT

Hello all,

Using Splunk 6.2.1 enterprise, with the wonderfull "predict" feature on my dataset.
Can't seem to solve the issue below:

_time values lower95(prediction(values)) prediction(values) upper95(prediction(values))
... some data rows before ...
2012-07-26 31 -15.013427956 21.8162478572 58.6459236703
2012-08-02 -16.3596947095 21.4794702433 59.3186351962
2012-08-09 14 -12.1226410825 26.6804984539 65.4836379903
2012-08-16 -20.651592529 19.0738757323 58.7993439937
2012-08-23 -19.7983081051 20.8112026898 61.4207134847
2012-08-30 -22.2166494183 19.241558569 60.6997665564
2012-09-06

2012-09-13

2012-09-20 46

2012-09-27 3

... some data rows after ...

From this point on there is no more prediction.

I've used the following search to get these results:

Hope someone can point me in the right direction.

Thanks,
Ken.

Re: predict does not span the full dataset

kenvanderheyden — Mon, 28 Sep 2020 18:31:22 GMT

Got this working for some part:
Using the future_timespan=150 it does now continue the prediction.

However the issue has now changed towards a prediction "flat line".
The prediction does not evolve / change after a certain point on the timeline.

While I have a weighted average that does span the full set, and does change over the complete line, predict does not.

Wonder what I might be missing here.

The changed line in the original script:
| timechart span=7d values(t_diff) as values | predict values algorithm=LL future_timespan=150 | trendline wma5(values)

Hope someone can share some wisdom in this ?

Thanks and a happy new year to everyone !

Ken.

Re: predict does not span the full dataset

HattrickNZ — Sun, 10 May 2015 22:26:21 GMT

can you show a picter of what your expierncing? have you tried playing with earlies and latest in your search, this seemed to be importatnt to me what i was using the predict function.