https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236085#M70114 <P>I have looked at the <CODE>predict</CODE> cause and the "x11", however, I'm still struggling to find the right searcg to get the data I want.</P> <P>Say I have 2 columns<BR /> Report_Date Population <BR /> 11/01/2015 122<BR /> 22/02/2015 125<BR /> 09/04/2015 141<BR /> 14/05/2015 155</P> <P>I would like to use the <CODE>predict</CODE> command to get the population at X date (say 01/01/2016). What should my search be? </P> <P>Any help is greatly appreciated.</P> Tue, 19 Jan 2016 06:46:07 GMT peterkn 2016-01-19T06:46:07Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236085#M70114 <P>I have looked at the <CODE>predict</CODE> cause and the "x11", however, I'm still struggling to find the right searcg to get the data I want.</P> <P>Say I have 2 columns<BR /> Report_Date Population <BR /> 11/01/2015 122<BR /> 22/02/2015 125<BR /> 09/04/2015 141<BR /> 14/05/2015 155</P> <P>I would like to use the <CODE>predict</CODE> command to get the population at X date (say 01/01/2016). What should my search be? </P> <P>Any help is greatly appreciated.</P> Tue, 19 Jan 2016 06:46:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236085#M70114 peterkn 2016-01-19T06:46:07Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236086#M70115 <P>Basically, you just use <CODE>| predict Population</CODE> for that. Keep in mind that in order to use the command, you need a <CODE>_time</CODE> field, so you will have to either change your search before that to use that field, or create it from <CODE>Report_Date</CODE> with strptime.</P> Tue, 19 Jan 2016 11:42:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236086#M70115 jeffland 2016-01-19T11:42:26Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236087#M70116 <P>On the same issue, I did use your approach and it works, so thanks. </P> <P>How do I use Predict for more than 1 column. </P> <P>Say I have another column called "Number of jobs available" or "Unemployment Rate", how do I predict these columns as well? Do I have to manually write the predict clause for each of the column? As I have about 10 columns I need to use the Predict function for.</P> Wed, 20 Jan 2016 03:46:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236087#M70116 peterkn 2016-01-20T03:46:57Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236088#M70117 <P>Unfortunately, you'll have to write your search like</P> <PRE><CODE>... | predict field_1 | predict field_2 </CODE></PRE> <P>because you can't use predict inside of <CODE>foreach</CODE>.</P> Wed, 20 Jan 2016 09:47:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-get-a-predicted-value-based-on-a-date/m-p/236088#M70117 jeffland 2016-01-20T09:47:18Z