Splunk Search

How to use fit command together with foreach?

Wonjon
Observer

I would like to fit an ARIMA model to my data with a search something like this:

<base search>
| timechart span=5m avg(value) as value by some_field

The problem here is that, the number of field that returns by this search is dynamic, so it can return 5 fields one day but it could also return 3 or 7 the other day for instance.

I would like to fit an ARIMA model to all the fields that is returned by that search. What I found was the foreach command where you iterate over fields :

| foreach * [eval '<<FIELD>>' = ... ]

 

However, when I try to use the fit command instead of eval, I get an error message saying: 

Error in 'foreach' command: Search pipeline may not contain non-streaming commands

Since foreach cannot contain non-streaming commands.

 

Is there a way to come around this issue?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...