I'm really new to Splunk's Machine Learning Toolkit, so any help would be greatly appreciated. Thank you.
I'm trying to forecast time series for multiple apps in my query. My current query is:
index=... report=1min_rollup app="..." earliest="06/07/2017:10:00:00" latest="06/07/2017:11:00:00" | stats sum(COUNT) as sum_count by _time,app | stats avg(sum_count) as avgCount by _time, app | bin _time span=5m | eval time=_time%3600 stats values(avgCount ) by _time, State | outputlookup eg.csv
This gives me the lookup table eg.csv which looks like:
_time |app| avgCount
Now, I want to forecast the avgCount of all the apps on seperate time series. How can I generate multiple forecasted time series (one forecasted time series per app) from the search that I do have right now???
Map command will perform quoted search for every row of table after dedup.
Actually, I'm not sure that I totally understand your initial search. For example, it seems that this part stats avg(sum_count) as avgCount by _time, app is useless, because you have already had rows grouped by _time and app after stats sum(COUNT) as sum_count by _time,app. And this part stats values(avgCount ) by _time, State return nothing, because there is no 'State' field in the results of previous stats.