All Apps and Add-ons

What is the maximum number of fields I can use in predict command?

sarauppal
Explorer

Hi super helpful splunk community.
I am stuck with an issue, I am using predict command using multiple fields, I have tried as high as 27 and it works fine, but when I try with 218 fields it doesn't give any errors but doesnt show any results either.

 <my search>
 |timechart Amount by Category limit=0 ("this generates field names that I need)
 |predict [another search here to make the same field list as above| return $field_list]

Also is there anyway I can make predict command not generate the upper 95 and lower 95 fields, just the prediction field?

inventsekar
SplunkTrust
SplunkTrust

Hi Sarauppal,
the Syntax says -
Description: The names of the fields for the variable that you want to predict. You can specify one or more fields.

Can you pls post your exact query, so that we can test/verify as well..
|predict [another search here to make the same field list as above| return $field_list]

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Checkout the predict documentation here : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Predict

It has all the options of predict command with examples

0 Karma

sarauppal
Explorer

It doesn't say anything about maximum fields, thanks though

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...