I have a working example for the using the predict function in the ML Toolkit to detect out outliers for an overall transaction count or for a single customer but I cannot figure out to use the function for multiple customers. Is that possible or would i need to setup a model for every customer? I need a way to show and alert the NOC if our top 20 customers have transaction count issues and of course static thresholds work poorly. Thanks!
I would not trust a model built on one data source (customer) for use on another, at least not without a great deal of testing.
Are you trying to predict or detect anomalies?
Couple of options :
As of MLTK 2.1, you could use the Detect Numeric Outliers with the "Fields to split by" for your customer fields, and use a sliding window too.
If you take a look at the Conf presentations from last year, https://conf.splunk.com/files/2016/slides/building-a-crystal-ball-forecasting-future-values-for-mult... is pretty awesome.
Are you looking to predict a number of transaction counts and then alert when the residual (actual - predicted/estimated) values differ? you can use the Predict Numeric Fields Assistant with some clever stats by client,dayofweek,hourofday, etc variables. You will have to understand how linear regression works.