Machine Learning Toolkit: For the Forecast Time Series function, how do I forecast the output to be categories?

[wb247459]

The Machine Learning Toolkit has "Forecast Time Series" function, it forecasts the numerical values. How do I forecast the output to be categories? Or at least, forecast the results in integer (0 or 1) instead of decimal values?

[aoliner_splunk]

Hi wb247459,

The predict command is built for numeric data, which is not what you have. For the case of binary data {0, 1}, you could use the predict command and then map the outputs to the nearest binary value, but it's not meant for that use case, so you might see strange results. For example, it may predict an increasing trend that eventually exceeds 1 (or more).

What I think you really want is something that learns sequences of categorical values. Although the Splunk User Behavior Analytics app does learn sequences of user actions, that's not a command that you could apply to, e.g., weather data, and I'm not aware of any such command elsewhere in Splunk.

Does that answer your question (even if it's not the answer you probably wanted)?

Cheers,
- Adam

[niketn]

@wb247459... What is the kind of field/value you are looking at?Can you add some sample data?

Forecast time series is essentially around the Splunk predict command, so ideally I would expect anything that can be put to a timechart can be predicted as well. If you have your data that can be put to a command like the following, you can think of predicting the same with Machine Learning Toolkit as well.

 <YourBaseSearch>
| timechart count 
| predict count

[wb247459]

my sample data is something like 0,0,1,0,0,0,1,0,0,1,0,0,0,1... by the hour, the predicted values should be 0,0,1... but not decimal values such as 0.01, 0.99, etc.

another sample input would be,
_time, weather
2017-01-01 12:00 sunny
2017-01-02 12:00 rain
...
2017-04-02 12:00 cloudy
forecast the weather for the next day.