Reporting

## Using MLTK to advice optimal resource usage

SplunkTrust

I do not have ML experience but I want to start getting my hands dirty with it. I have some inputs that I would like MLTK to crunch to advice the best usage of some resources.
The use case here is: I have some booths to where people get attended and I have a waiting queue with check in and checkout for those booths. I want to predict is how many booths should I have open to keep the queue waiting times below a certain threshold. The pax volume can vary wildly during the day.

What do I know?
I know when someone arrived at the queue (timestamp) and when that person is ready to use the booth as in leaving the waiting queue (timestamp)
I know the booth possible capacity (x pax/h)
I know my waiting time threshold (x minutes)

What do I want to know?
Predict based on historical data how many booths should have open to be able to have the waiting times below the threshold. as a way to do capacity planning for the future (e.g tomorrow at 1pm I should have 5 booths open based on data from same day last week, month or year)
Based on near real time data (waiting times, queue size, open booths, etc) advice opening or closing booths to accomplish optimal usage of resources and avoid crossing the waiting time threshold. (e.g there's an different volume of people so in order to keep waiting times low I should open 2 more booths)

------------
Hope I was able to help you. If so, an upvote would be appreciated.
Labels (1)
• ### other

Tags (2)
Builder

Have you considered solving the problem analytically using a queuing model?

"I know when someone arrived at the queue (timestamp) and when that person is ready to use the booth as in leaving the waiting queue (timestamp)"

This represents 1) our inter-arrival time (the interval between arrivals) t, the inverse of which is the arrival rate 1/t or λ (lambda), and 2) our average waiting time Wq.

"I know the booth possible capacity (x pax/h)"

This represents our service rate μ (mu) in customers per unit t, the inverse of which is the service time 1/μ or s.

"I know my waiting time threshold (x minutes)"

This represents our maximum average waiting time max[Wq]. In terms of our model, this is target value. I.e. We want to know how many servers (booths) are necessary to maintain Wq <= max[Wq].

As a starting point, I put together a simple M/M/c queue dashboard with inputs for servers (booths), arrival rate, service rate, and a unit label. The outputs include:

• Average Customers in System (L)
• Average Customers in Queue (Lq)
• Average Time in System (W)
• Average Time Waiting in Queue (Wq)
• Server Utilization (ρ) (rho)

Given your known values for arrival rate and service rate, you can increment servers until Wq is at or below your threshold.

With a little work, the dashboard can be modified to accept a target Wq value and then display the optimal number of servers.

``````<form>
<!-- M/M/c formulas: https://web.mst.edu/~gosavia/queuing_formulas.pdf -->
<!-- Approximation of factorial: http://hyperphysics.phy-astr.gsu.edu/hbase/Math/stirling.html -->
<label>M/M/c Queue</label>
<fieldset submitButton="false">
<input type="text" token="c">
<label>Servers (c)</label>
<default>2</default>
</input>
<input type="text" token="lambda">
<label>Arrival Rate (λ)</label>
<default>1</default>
</input>
<input type="text" token="mu">
<label>Service Rate (μ)</label>
<default>2</default>
</input>
<input type="text" token="units">
<label>Units</label>
<default>secs</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Average Customers in System (L)</title>
<search>
<query>| makeresults | eval L=exact(\$lambda\$*\$W\$) | table L</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
</single>
</panel>
<panel>
<single>
<title>Average Customers in Queue (Lq)</title>
<search>
<done>
<set token="Lq">\$result.Lq\$</set>
</done>
<query>| makeresults
| eval p=
[| makeresults count=\$c\$
| eval rho=\$rho\$
| eventstats count as c
| streamstats count as m
| eval m=m-1, p=exact(pow(c*rho,m)/round(if(m==0,1,sqrt(2*pi()*m)*pow(m/exp(1),m)*(1+(1/(12*m))))))
| stats max(c) as c max(rho) as rho sum(p) as p
| eval p=exact(1/(p+(pow(c*rho,c)/(round(if(m==0,1,sqrt(2*pi()*c)*pow(c/exp(1),c)*(1+(1/(12*c)))))*(1-rho)))))
| return \$p]
| eval Lq=exact((p*pow(\$lambda\$/\$mu\$,\$c\$)*\$rho\$)/(round(if(m==0,1,sqrt(2*pi()*\$c\$)*pow(\$c\$/exp(1),\$c\$)*(1+(1/(12*\$c\$)))))*pow(1-\$rho\$,2)))
| table Lq</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<title>Average Time in System (W)</title>
<search>
<done>
<set token="W">\$result.W\$</set>
</done>
<query>| makeresults | eval W=exact(\$Wq\$+(1/\$mu\$)) | table W</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
<option name="unit">\$units\$</option>
</single>
</panel>
<panel>
<single>
<title>Average Time Waiting in Queue (Wq)</title>
<search>
<done>
<set token="Wq">\$result.Wq\$</set>
</done>
<query>| makeresults | eval Wq=exact(\$Lq\$/\$lambda\$) | table Wq</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
<option name="unit">\$units\$</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<title>Server Utilization (ρ)</title>
<search>
<done>
<set token="rho">\$result.rho\$</set>
</done>
<query>| makeresults | eval rho=exact(\$lambda\$/(\$c\$*\$mu\$)) | table rho</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.000</option>
</single>
</panel>
</row>
</form>``````

Did you miss .conf21 Virtual?

### Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE! Catch Up Now >>

Get Updates on the Splunk Community!