I have a working example for the using the predict function in the ML Toolkit to detect out outliers for an overall transaction count or for a single customer but I cannot figure out to use the function for multiple customers. Is that possible or would i need to setup a model for every customer? I need a way to show and alert the NOC if our top 20 customers have transaction count issues and of course static thresholds work poorly. Thanks!
Are you trying to predict or detect anomalies?
Couple of options :
As of MLTK 2.1, you could use the Detect Numeric Outliers with the "Fields to split by" for your customer fields, and use a sliding window too.
If you take a look at the Conf presentations from last year, https://conf.splunk.com/files/2016/slides/building-a-crystal-ball-forecasting-future-values-for-mult... is pretty awesome.
Are you looking to predict a number of transaction counts and then alert when the residual (actual - predicted/estimated) values differ? you can use the Predict Numeric Fields Assistant with some clever stats by client,dayofweek,hourofday, etc variables. You will have to understand how linear regression works.