Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Exponential Smoothing Implementation in Splunk

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Exponential Smoothing Implementation in Splunk

samsplunkd

Path Finder

01-02-2013
02:59 PM

Hi,

I am planning to implement exponential smoothing in Splunk based on below formula where

s1 is the forecasted value. At time t=0, it is equal to first event. For time=t, it is calculated based on below formula. I can hard code value for "alpha".

s1=x0

s{t}=[alpha * x{t-1}] + [(1-alpha)s{t-1}], t>1

For time=t, it is referring to previously calculated forecast value (s{t-1}) and previous event value (x{t-1}) so not sure how this can be achieved using Splunk.

Say the log data is like below and "total" is the field which needs to be used(x{t}) to calcuate forecasted value(s{t}). I know there will be a field named "total" created which contains all the values but is there a way I can refer to say first value in field "total" like total0 which will be equal to 4, total[1] which will be equal to 6?

1/2/13 2:30:00.000 PM total=4

1/2/13 2:31:00.000 PM total=6

1/2/13 2:32:00.000 PM total=8

1/2/13 2:33:00.000 PM total=10

Any help is greatly appreciated.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Exponential Smoothing Implementation in Splunk

yannK

Splunk Employee

01-02-2013
07:18 PM

To do a cumulative total in a new field, take a look at the function eventstats.

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Eventstats

and maybe too at the function predict that may already do what you want.

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Predict

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Exponential Smoothing Implementation in Splunk

samsplunkd

Path Finder

01-03-2013
12:05 AM

Thanks for the reply But my requirement is little different. This formula expects values from previous calculated results so I would like to know if there is a way I can refer to field values separately like arrays as specified in my question above.

s{t}=[alpha * x{t-1}] + [(1-alpha)s{t-1}], t>1

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Exponential Smoothing Implementation in Splunk

jonuwz

Influencer

01-03-2013
03:11 AM

The trick here is to make all the data required for the calculation in the current event.

Looking at the formula, it only relies on the previous value of x and the previous value of s.

You can pull the previous value of a field into the current event like this :

```
... | streamstats window=1 current=f total as prev_total
```

so now you have access to x{t} and x{t-1} in the event. ( total and prev_total fields respectively)

You'll also need to pre-populat the 1st valid value of s, then you can use the above method to 'stream' the previous value of s into the current event to calculate s{t}