All Apps and Add-ons

Splunk Predict App: How to use SPL to forecast

parveen77
New Member

New to Splunk and trying to follow this example here:
https://discoveredintelligence.ca/forecasting-time-series-data-using-splunk-machine-learning-toolkit... using my data

time value
2019/07/02 22:35:00 1248.2
2019/07/02 06:15:00 1266.05
2019/07/02 06:35:00 1274.17
2019/07/02 06:45:00 1277.12
2019/07/02 19:50:00 1277.8
2019/07/02 23:40:00 1279.41
2019/07/02 16:15:00 1285.74
2019/07/02 20:20:00 1286.51
2019/07/02 06:25:00 1287.84
2019/07/02 20:10:00 1288.02
2019/07/02 06:30:00 1289.44
2019/07/02 22:20:00 1290.35
2019/07/02 06:05:00 1292.87

But I get this error:

External search command 'predict' returned error code 1. . 

I checked answers to similar issue and recommendation was to create a timechart.
The example I have been following and running in Splunk has not done so and the example runs fine for me, but with my data I get error.

Any pointers would be super helpful.

Thanks

0 Karma
1 Solution

Sukisen1981
Champion

hi @parveen77
The unit for the span specified with the timechart command must be seconds or higher. The predict command cannot accept subseconds as an input when it calculates the period.
So if i do this

 index="_audit"
    | stats count(action) by _time 
    | rename count(action) as count 
    |  predict count

i get the error code -1
but if i just put a span of 1 min and use the same code with the bin command added

index="_audit"
| bin span=1min _time
| stats count(action) by _time 
| rename count(action) as count 
|  predict count

I receive the results.
Timechart is not mandatory and you can run both these code snaps as it is, since i ran this on the delivered _audit index for the last 24 hrs.
If you use timechart you need to use span (min 1 sec), if you use something else like stats or a table you have to take care of the time buckets using the bin command

View solution in original post

0 Karma

Sukisen1981
Champion

hi @parveen77
The unit for the span specified with the timechart command must be seconds or higher. The predict command cannot accept subseconds as an input when it calculates the period.
So if i do this

 index="_audit"
    | stats count(action) by _time 
    | rename count(action) as count 
    |  predict count

i get the error code -1
but if i just put a span of 1 min and use the same code with the bin command added

index="_audit"
| bin span=1min _time
| stats count(action) by _time 
| rename count(action) as count 
|  predict count

I receive the results.
Timechart is not mandatory and you can run both these code snaps as it is, since i ran this on the delivered _audit index for the last 24 hrs.
If you use timechart you need to use span (min 1 sec), if you use something else like stats or a table you have to take care of the time buckets using the bin command

0 Karma

Sukisen1981
Champion

hi @parveen77
Please accept the answer if it significantly helped resolve your issue or let us know if there are any more issues

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...