How to apply predict command on multiple fields returned by timechart command?

[Taruchit]

Hello @kamlesh_vaghela,

This is with regards to your solution posted on the below thread: -

https://community.splunk.com/t5/Splunk-Search/How-to-apply-the-predict-function-for-the-most-varying...

I have relatively similar use case, I have multiple columns, the first column is of _time and the remaining column fields are distinct having numeric data for each timestamp.

I need to compute the forecast value using the predict command. I tried to use your approach of looping through fields using foreach and then passing it to predict command. However, it takes only one field and its values and computes the forecast value. I need to calculate the same for all the fields returned by the timechart command.

Thus, it would be very helpful to seek your inputs on the same.

Thank you
Taruchit

[isoutamo]

Hi

maybe this gives you enough hints for your own issue?

index=_internal sourcetype=splunkd* 
| timechart span=1m useother=f count as Count by sourcetype where stdev in top2
| untable _time sourcetype count1
| foreach "*" 
    [ eval column_value=count1, column_name=sourcetype ] 
| fields - sourcetype count1
| predict column_value future_timespan=14 
| filldown column_name 
| eval {column_name}=column_value, "prediction({column_name})"='prediction(column_value)',
    "lower95(prediction({column_name}))"='lower95(prediction(column_value))',
    "upper95(prediction({column_name}))"='upper95(prediction(column_value))' 
| eval _lower = "lower95(prediction(".column_name."))", _upper = "upper95(prediction(".column_name."))", _predicted = "prediction(".column_name.")" 
| fields - column_value column_name "prediction(column_value)"  upper95* lower95*

This is based on @kamlesh_vaghela's example and @VatsalJagani 's resolution for his issue.

r. Ismo