How to forecast multiple time series from one search ?

[EvaRex]

Hello!

I'm really new to Splunk's Machine Learning Toolkit, so any help would be greatly appreciated. Thank you.

I'm trying to forecast time series for multiple apps in my query. My current query is:

index=... report=1min_rollup app="..." earliest="06/07/2017:10:00:00" latest="06/07/2017:11:00:00" | stats sum(COUNT) as sum_count by _time,app | stats avg(sum_count) as avgCount by _time, app | bin _time span=5m | eval time=_time%3600 stats values(avgCount ) by _time, State | outputlookup eg.csv

This gives me the lookup table eg.csv which looks like:

 _time |app|  avgCount
 ...

Now, I want to forecast the avgCount of all the apps on seperate time series. How can I generate multiple forecasted time series (one forecasted time series per app) from the search that I do have right now???

Thank you! Your help is greatly appreciated!

[nryabykh]

Hello!

If you don't know the exact number and names of apps, you can do smth like that:

| inputlookup eg.csv 
| dedup app 
| map search=" | inputlookup eg.csv | search app=$app$ | timechart span=5min avg(avgCount) as avgCount | predict avgCount future_timespan=10 | eval app=$app$ "
| table _time, avgCount, "prediction(avgCount)", app
| xyseries _time, app, "prediction(avgCount)"

Map command will perform quoted search for every row of table after dedup.

Actually, I'm not sure that I totally understand your initial search. For example, it seems that this part stats avg(sum_count) as avgCount by _time, app is useless, because you have already had rows grouped by _time and app after stats sum(COUNT) as sum_count by _time,app. And this part stats values(avgCount ) by _time, State return nothing, because there is no 'State' field in the results of previous stats.

[Suhailahmed648]

Is there any other way, without using 'Map' command?
It is very high resource consuming.