Do predict and timeswrap mix?

[splunkernator]

Hi forum!

getting a bit muddled here, I want to statistically demonstrate a recurring weekly trend , so timewrap sounds great.  Then again I want to work out a 95% variation of this, so predict sounds awesome.

I want to do this so that I can hopefully create an action (alert) condition based on overlaying this variance on a real time data series: enabling me (hopefully) to answer the question "is this normal or not?"

When I look at what the two commands do, they seem to want to do different things - I mean how can you predict a timewrap that circles back by design?  So splunk - understandably errors - an I ask for forgiveness of my bad logic 🙂 . 

Can anyone give me any advice?

[johnhuang]

For weekly/seasonality trends, you can set the algorithm to LLP. Let's say you're trying to predict the number of events by day of the week, you set your span=1d and your period to 7 (which is 7 days)

| tstats count WHERE (index=_internal sourcetype=splunkd_access earliest=-4w@w latest=-0d@d) by _time sourcetype span=1d
| timechart span=1d sum(count) AS event_ct
| predict event_ct algorithm=LLP period=7