All Apps and Add-ons

What is the maximum number of fields I can use in predict command?

sarauppal
Explorer

Hi super helpful splunk community.
I am stuck with an issue, I am using predict command using multiple fields, I have tried as high as 27 and it works fine, but when I try with 218 fields it doesn't give any errors but doesnt show any results either.

 <my search>
 |timechart Amount by Category limit=0 ("this generates field names that I need)
 |predict [another search here to make the same field list as above| return $field_list]

Also is there anyway I can make predict command not generate the upper 95 and lower 95 fields, just the prediction field?

inventsekar
SplunkTrust
SplunkTrust

Hi Sarauppal,
the Syntax says -
Description: The names of the fields for the variable that you want to predict. You can specify one or more fields.

Can you pls post your exact query, so that we can test/verify as well..
|predict [another search here to make the same field list as above| return $field_list]

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

grana_splunk
Splunk Employee
Splunk Employee

Checkout the predict documentation here : http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Predict

It has all the options of predict command with examples

0 Karma

sarauppal
Explorer

It doesn't say anything about maximum fields, thanks though

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...