Splunk Search

How to apply predict command on multiple fields returned by timechart command?

Taruchit
Contributor

Hello @kamlesh_vaghela,

This is with regards to your solution posted on the below thread: -

https://community.splunk.com/t5/Splunk-Search/How-to-apply-the-predict-function-for-the-most-varying...

I have relatively similar use case, I have multiple columns, the first column is of _time and the remaining column fields are distinct having numeric data for each timestamp.

I need to compute the forecast value using the predict command. I tried to use your approach of looping through fields using foreach and then passing it to predict command. However, it takes only one field and its values and computes the forecast value. I need to calculate the same for all the fields returned by the timechart command.

Thus, it would be very helpful to seek your inputs on the same.

Thank you
Taruchit

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

maybe this gives you enough hints for your own issue?

index=_internal sourcetype=splunkd* 
| timechart span=1m useother=f count as Count by sourcetype where stdev in top2
| untable _time sourcetype count1
| foreach "*" 
    [ eval column_value=count1, column_name=sourcetype ] 
| fields - sourcetype count1
| predict column_value future_timespan=14 
| filldown column_name 
| eval {column_name}=column_value, "prediction({column_name})"='prediction(column_value)',
    "lower95(prediction({column_name}))"='lower95(prediction(column_value))',
    "upper95(prediction({column_name}))"='upper95(prediction(column_value))' 
| eval _lower = "lower95(prediction(".column_name."))", _upper = "upper95(prediction(".column_name."))", _predicted = "prediction(".column_name.")" 
| fields - column_value column_name "prediction(column_value)"  upper95* lower95*

This is based on @kamlesh_vaghela's example and @VatsalJagani 's resolution for his issue.

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...