All Apps and Add-ons

Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ?

bibinksebastian
Explorer

I am using MLTK 4.3 Smartforecasting to model a time series . Forecasting works well with fit command . as soon as I try to use the model that was trained, it throws ambiguous errors(ambiguous to me ) . Search queries as below.
fit query:

source="119_AB_July10.csv" host="AB" index="july10" sourcetype="csv"| reverse | fit StateSpaceForecast "Tput_Gbps" output_metadata=true period=96 holdback=96 conf_interval=95 forecast_k=192 into "july11" | table *
apply query :
source="119_AB_July10.csv" host="AB" index="july10" sourcetype="csv"| reverse | apply july11 | table *

I think I am making some mistake somewhere. Please support.

0 Karma
1 Solution

grana_splunk
Splunk Employee
Splunk Employee

What error you are getting? Can you add more detail?

Holdback is the number of data points held back to test the model.Your holdback should be less than the Future timespan

Also, I see a table command without any fields..It will not work unless you have a field after it.Another suggestion would be to use Smart Forecasting new Experiment workflow in 4.3. Check this blog for more info : https://www.splunk.com/blog/2019/06/03/what-s-new-in-the-splunk-machine-learning-toolkit-4-3.html

View solution in original post

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

What error you are getting? Can you add more detail?

Holdback is the number of data points held back to test the model.Your holdback should be less than the Future timespan

Also, I see a table command without any fields..It will not work unless you have a field after it.Another suggestion would be to use Smart Forecasting new Experiment workflow in 4.3. Check this blog for more info : https://www.splunk.com/blog/2019/06/03/what-s-new-in-the-splunk-machine-learning-toolkit-4-3.html

0 Karma

bibinksebastian
Explorer

This is the error I am getting. "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." Holdback is less than forecast_k . I even tried setting hold back to 0 . Regarding the table, there was a "star" after it which was removed somehow !!
Any idea what is the error about ?

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Can you please remove the reverse and check?

0 Karma

bibinksebastian
Explorer

Thanks.reverse is there to mitigate error while fitting the model. I removed the reverse command and tested. It gives me the same error

0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Can you please specify the holdback and forecast_k in apply command? when you're running |apply, the data had only 50 data points and period is set to 96 during fit. That’s why the error happened. The number of data points must be >= the period.

bibinksebastian
Explorer

Hi Grana.. It looks like a bug to me.. did the whole process again the apply command works. But when I reduce the number of days to it as input to the apply command, it gives me duplicate predictions (4 rows with different predicted values for the same time ) . Working on how to fix that now !!

0 Karma

bibinksebastian
Explorer

Looks like adding the exact parameters like holdout and forecast along with feeding the data using time chart worked . Thanks Gyanendra.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...