All Apps and Add-ons

What is the maximum number of fields I can use in predict command?

sarauppal
Explorer

Hi super helpful splunk community.
I am stuck with an issue, I am using predict command using multiple fields, I have tried as high as 27 and it works fine, but when I try with 218 fields it doesn't give any errors but doesnt show any results either.

 <my search>
 |timechart Amount by Category limit=0 ("this generates field names that I need)
 |predict [another search here to make the same field list as above| return $field_list]

Also is there anyway I can make predict command not generate the upper 95 and lower 95 fields, just the prediction field?

inventsekar
SplunkTrust
SplunkTrust

Hi Sarauppal,
the Syntax says -
Description: The names of the fields for the variable that you want to predict. You can specify one or more fields.

Can you pls post your exact query, so that we can test/verify as well..
|predict [another search here to make the same field list as above| return $field_list]

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Checkout the predict documentation here : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Predict

It has all the options of predict command with examples

0 Karma

sarauppal
Explorer

It doesn't say anything about maximum fields, thanks though

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...