Splunk Search

How to write a search to get a predicted value based on a date and a number of data points?

peterkn
Explorer

I have looked at the predict cause and the "x11", however, I'm still struggling to find the right searcg to get the data I want.

Say I have 2 columns
Report_Date Population
11/01/2015 122
22/02/2015 125
09/04/2015 141
14/05/2015 155

I would like to use the predict command to get the population at X date (say 01/01/2016). What should my search be?

Any help is greatly appreciated.

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Basically, you just use | predict Population for that. Keep in mind that in order to use the command, you need a _time field, so you will have to either change your search before that to use that field, or create it from Report_Date with strptime.

View solution in original post

0 Karma

jeffland
SplunkTrust
SplunkTrust

Basically, you just use | predict Population for that. Keep in mind that in order to use the command, you need a _time field, so you will have to either change your search before that to use that field, or create it from Report_Date with strptime.

0 Karma

peterkn
Explorer

On the same issue, I did use your approach and it works, so thanks.

How do I use Predict for more than 1 column.

Say I have another column called "Number of jobs available" or "Unemployment Rate", how do I predict these columns as well? Do I have to manually write the predict clause for each of the column? As I have about 10 columns I need to use the Predict function for.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Unfortunately, you'll have to write your search like

... | predict field_1 | predict field_2

because you can't use predict inside of foreach.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...