Dashboards & Visualizations

draw treshold line in predict forecastviz

pitmod
Explorer

Hello,

how can I add treshold line in my forecastviz? I've tried as below but it's not visable on the chart. With normal line chart it works fine.

| mysearch

| eval Treshold=90| timechart span=120min latest(Treshold) as Treshold avg(MyPredictedValue) as PredictedValue
| predict "PredictedValue" as prediction algorithm=LLT holdback=12 future_timespan=96 upper95=upper95 lower95=lower95 | `forecastviz(96, 12, "PredictedValue", 95)`

| filldown Threshold 

Labels (2)
1 Solution

t_shreya
Path Finder

@pitmod I'm sorry, I misunderstood your question and thought that you wanted a vertical threshold line.

I'm not completely sure for the horizontal threshold, but can you try something like this?

| mysearch

| eval Treshold=90| timechart span=120min latest(Treshold) as Treshold avg(MyPredictedValue) as PredictedValue
| predict "PredictedValue" as prediction algorithm=LLT holdback=12 future_timespan=96 upper95=upper95 lower95=lower95 
| eval _ft=96
| eval _hb=12
| eval _vars=mvappend("PredictedValue","Treshold")
| eval _ci=95

View solution in original post

t_shreya
Path Finder

Hi @pitmod ,

I think this may work. Replace `forecastviz(96, 12, "PredictedValue", 95)` with the following :
| eval _ft=96
| eval _hb=12
| eval _vars="PredictedValue"
| eval _ci=95

I'd replaced the macro with it's definition in the query and it had worked for me.

Added threshold to forecast chartAdded threshold to forecast chart

 

 

pitmod
Explorer

@t_shreya Which makro should be edited? On the screenshot you've attached I don't see a horizontal threshold line.

t_shreya
Path Finder

@pitmod I'm sorry, I misunderstood your question and thought that you wanted a vertical threshold line.

I'm not completely sure for the horizontal threshold, but can you try something like this?

| mysearch

| eval Treshold=90| timechart span=120min latest(Treshold) as Treshold avg(MyPredictedValue) as PredictedValue
| predict "PredictedValue" as prediction algorithm=LLT holdback=12 future_timespan=96 upper95=upper95 lower95=lower95 
| eval _ft=96
| eval _hb=12
| eval _vars=mvappend("PredictedValue","Treshold")
| eval _ci=95

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...