All Apps and Add-ons

How to forecast multiple time series from one search ?

EvaRex
Engager

Hello!

I'm really new to Splunk's Machine Learning Toolkit, so any help would be greatly appreciated. Thank you.

I'm trying to forecast time series for multiple apps in my query. My current query is:

index=... report=1min_rollup app="..." earliest="06/07/2017:10:00:00" latest="06/07/2017:11:00:00" | stats sum(COUNT) as sum_count by _time,app | stats avg(sum_count) as avgCount by _time, app | bin _time span=5m | eval time=_time%3600 stats values(avgCount ) by _time, State | outputlookup eg.csv

This gives me the lookup table eg.csv which looks like:

 _time |app|  avgCount
 ...

Now, I want to forecast the avgCount of all the apps on seperate time series. How can I generate multiple forecasted time series (one forecasted time series per app) from the search that I do have right now???

Thank you! Your help is greatly appreciated!

0 Karma

nryabykh
Path Finder

Hello!

If you don't know the exact number and names of apps, you can do smth like that:

| inputlookup eg.csv 
| dedup app 
| map search=" | inputlookup eg.csv | search app=$app$ | timechart span=5min avg(avgCount) as avgCount | predict avgCount future_timespan=10 | eval app=$app$ "
| table _time, avgCount, "prediction(avgCount)", app
| xyseries _time, app, "prediction(avgCount)"

Map command will perform quoted search for every row of table after dedup.

Actually, I'm not sure that I totally understand your initial search. For example, it seems that this part stats avg(sum_count) as avgCount by _time, app is useless, because you have already had rows grouped by _time and app after stats sum(COUNT) as sum_count by _time,app. And this part stats values(avgCount ) by _time, State return nothing, because there is no 'State' field in the results of previous stats.

0 Karma

Suhailahmed648
Engager

Is there any other way, without using 'Map' command?
It is very high resource consuming.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...