All Apps and Add-ons

Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ?

I am using MLTK 4.3 Smartforecasting to model a time series . Forecasting works well with fit command . as soon as I try to use the model that was trained, it throws ambiguous errors(ambiguous to me ) . Search queries as below.
fit query:

source="119ABJuly10.csv" host="AB" index="july10" sourcetype="csv"| reverse | fit StateSpaceForecast "TputGbps" outputmetadata=true period=96 holdback=96 confinterval=95 forecastk=192 into "july11" | table *
apply query :
source="119ABJuly10.csv" host="AB" index="july10" sourcetype="csv"| reverse | apply july11 | table *

I think I am making some mistake somewhere. Please support.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

What error you are getting? Can you add more detail?

Holdback is the number of data points held back to test the model.Your holdback should be less than the Future timespan

Also, I see a table command without any fields..It will not work unless you have a field after it.Another suggestion would be to use Smart Forecasting new Experiment workflow in 4.3. Check this blog for more info : https://www.splunk.com/blog/2019/06/03/what-s-new-in-the-splunk-machine-learning-toolkit-4-3.html

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

What error you are getting? Can you add more detail?

Holdback is the number of data points held back to test the model.Your holdback should be less than the Future timespan

Also, I see a table command without any fields..It will not work unless you have a field after it.Another suggestion would be to use Smart Forecasting new Experiment workflow in 4.3. Check this blog for more info : https://www.splunk.com/blog/2019/06/03/what-s-new-in-the-splunk-machine-learning-toolkit-4-3.html

View solution in original post

0 Karma

This is the error I am getting. "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." Holdback is less than forecast_k . I even tried setting hold back to 0 . Regarding the table, there was a "star" after it which was removed somehow !!
Any idea what is the error about ?

0 Karma

Splunk Employee
Splunk Employee

Can you please remove the reverse and check?

0 Karma

Thanks.reverse is there to mitigate error while fitting the model. I removed the reverse command and tested. It gives me the same error

0 Karma

Splunk Employee
Splunk Employee

Can you please specify the holdback and forecast_k in apply command? when you're running |apply, the data had only 50 data points and period is set to 96 during fit. That’s why the error happened. The number of data points must be >= the period.

Hi Grana.. It looks like a bug to me.. did the whole process again the apply command works. But when I reduce the number of days to it as input to the apply command, it gives me duplicate predictions (4 rows with different predicted values for the same time ) . Working on how to fix that now !!

0 Karma

Looks like adding the exact parameters like holdout and forecast along with feeding the data using time chart worked . Thanks Gyanendra.

0 Karma