Other Usage

Unable to perform Seasonal-Trend decomposition on timechart

POR160893
Builder

Hi,

I have a timechart of number of events over a 7 day period and I need to run a Seasonal-Trend decomposition on the results.

This is my current query:
[BASE QUERY]
| timechart span=1h count
| streamstats window=24 avg(count) as hourly_avg_count
| timechart span=1h stl hourly_avg_count as seasonal component=longterm

However, I am getting the error: Unknown search command 'stl'.

Can you please help?

Many thanks!



Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I think the stl command is part of the Deep Learning Toolkit - do you have that installed?

0 Karma

POR160893
Builder
Spoiler
I don't sadly, not permitted in my work
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK then you may need to go back to basics and define what it is you would like to get from your data in terms of what commands you do have available.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...