How would I use my own data on Splunk Free with ML Toolkit?

[arianalema]

Hi,

I am using the below for data that I have uploaded and I get 0 events. When I go to datasets/tables, I see this dataset. Why does it not work when I call it within the ML Toolkit? Thanks!
| inputlookup weeklyTrends-sundayGrowthUnderlying.csv

[adonio]

check permissions on your lookup maybe.
if you added it via GUI, its probably has private permissions, as this is the default.
click in settings, top right corner -> lookups -> Lookup Table Files -> find your file -> scroll to the right -> hit permissions -> change to global (all apps) -> save

hope it helps

[arianalema]

Hi,
That did give me access but in Kalman Filter I get "External search command 'predict' returned error code 1."
Do you have any idea as to why this would come up? It once showed me the results in a flash then took them away and popped up this error.
Code:
* source="weeklyTrends-growthUnderlying (1).csv" | predict "value" as prediction algorithm=LLP5 holdback=10000 future_timespan=10005 upper95=upper95 lower95=lower95 | forecastviz(10005, 10000, "value", 95)

Thanks again!

EDIT: It works with a smaller dataset but I get the error after ~10k observations only.

[Sukisen1981]

hmmm interesting , now holback is as per the definition
holdbackSyntax: holdback=Description: Specifies the number of data points from the end that are not to be used by the predict command. Use in conjunction with the future_timespan argument. For example, 'holdback=10 future_timespan=10' computes the predicted values for the last 10 values in the data set. You can then judge how accurate the predictions are by checking whether the actual data point values fall into the predicted confidence intervals. Default: 0
So, what I am not getting is if you have a data set of 10K observations AND you holdback the entire 10k as shown here , then what are you basing the prediction upon?
if i modify your query to something like * source="weeklyTrends-growthUnderlying (1).csv" | predict "value" as prediction algorithm=LLP5 holdback=1000 future_timespan=1000 upper95=upper95 lower95=lower95 | forecastviz(10005, 10000, "value", 95)
Does it work?

[adonio]

this has to do with limits settings, i dont have it top of my head but i am positive a quick search will give you the answer. will look for it later