Splunk Enterprise

Splunk ML Toolkit - Why this error "External search command 'predict' returned error code 1" after upgrade?

FreelanceRob
Engager

Hi all,

I have a dashboard that uses the time series forecast from Splunk Machine Learning Toolkit. Until few weeks ago we were using it with Splunk 8.0.2 and ML Toolkit version 5.2.1 and it was working fine. After upgrading to Splunk 8.2.4 the "predict" command is returning the following error:

 

External search command 'predict' returned error code 1. .

 

I also tried to upgrade the ML Toolkit to version 5.3.1 which states to be compatible with Splunk 8.2.4 and with Python3 (I suppose this is the issue) but the error still occurs.

Here's my search:

 

index=myindex earliest=-5w@w latest=now 
| timechart span=10m count 
| predict "count" as prediction algorithm=LLP holdback=100 future_timespan=300 period=1008 upper75=upper75 lower75=lower75 
| `forecastviz(300, 100, "count", 75)`

 

Before the Splunk upgrade it was working correctly.

Anyone had the same issue after upgrading Splunk and can help me fix it? Thanks!

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...