I have a Forecast time series that runs in the Machine Learning App correctly.
What I want to do is integrate that into a dashboard so I can feed it some tokens to run for different hosts.
I am re-reading through to documentation to see if something is missed, I do not have a saved model from
this I see that I can use the apply function.
Does any specific permission need to be changed in order for the ML to talk to the Search app?
I get the following error:
"Error in 'SearchParser': The search specifies a macro 'forecastviz' that cannot be found. Reasons include: the macro name is misspelled, you do not have "read" permission for the macro, or the macro has not been shared with this application. Click Settings, Advanced search, Search Macros to view macro information."
We need WAAAAAAY more detail. Show us ALL of your SPL.
@woodcock Search is below; I was more questioning the permission aspect, not so much the syntax if that makes sense. I want to make sure if there is anything needed so I can import my ML items as a Dashboard Panel. I am really the only user and the setup is done by another team and I do not get much insight. To get the search I went in to the ML ran my Experiment then selected show in search. I then copied and pasted it into a Search and Reporting search.
sourcetype=userservice | where Accounts<1250 AND Accounts > 750 | eval MStoS=case(Milliseconds!=0,Milliseconds/1000,Milliseconds = 0, 0) | eval MtoS =case(Seconds!=0,Seconds/1000,Seconds = 0, 0) | eval TotalTime = MtoS + MStoS + Seconds | eval SPerAccount=(TotalTime/Accounts) | bucket _time span=day | stats sum(Accounts) AS Accounts,sum(TotalTime) AS ProcessingTime, avg(SPerAccount) AS SPerAccount, count(_raw) AS Batch by _time | where ProcessingTime > 1000 AND ProcessingTime < 20000 | predict "ProcessingTime" as prediction algorithm=LLP5 holdback=0 future_timespan=1 period=1 upper80=upper80 lower80=lower80 | `forecastviz(1, 0, "ProcessingTime", 80)`
It runs fine in the ML search area, but fails in the Search and Reporting which makes me think there is some permission item.
The MLTK creates a custom command
forecastviz. You ought to be able to go into the
MLTK app, then click
Advanced search ->
Search commands (or possibly
macros if it is actually a macro) , search for it, find it, then click
Permissions and change it to
All Apps which is
This was it. In this case it was Macros and they are only shared in the App.