Split data into a training set and a testing set

[emma1]

Hi,

I am trying to train a LSTM time series classifier in the search window in Splunk, step 4 in Model Development Guide in deep learning toolkit.

It says that the data can be split into a training set and a testing set using the | sample command. To my understanding, the datasets is then constructed by taken events randomly.  I do not want datasets that is constructed by taking events randomly. I want the data to be sorted by time and then split with a ratio, how can I do this?

Splunk version: 7.2.4

Deep Learning Toolkit for Splunk Version: 2.3.0

[richgalloway · Accepted solution]

You could take every other (or some number) event using the modulo operator.

| where (_time % 2 = 0)