Splunk Search

Is the Splunk predict command useful?

kdimaria
Communicator

So, I have a graph that shows the total user logins per day for an application and I thought it would be cool to show the ability to predict what the total number of logins for the next month would be. So the current graph just shows the previous month of total user log ins each day and when I use predict:

| predict Users period=30 future_timespan=30

It basically just mirrors the previous month to the future month since it is looking at the past 30 days. Is there a way to grab more "before" data than what I am displaying so that the predict doesn't just mirror the previous 30 days?

0 Karma
1 Solution

cmerriman
Super Champion

You can read about two forecasting commands here (x11 and predict)
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Search/Aboutpredictiveanalytics
x11 removes seasonality whereas predict provides forecasting for various levels (see algorithms http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Predict#Predict_options)

for either command, to look back further in your data, just set your period to a larger number. If you're looking at the last 30 data points right now, maybe expand to the last 60 data points while looking at the last 60 days?

In my opinion, these commands can be very helpful

View solution in original post

0 Karma

cmerriman
Super Champion

You can read about two forecasting commands here (x11 and predict)
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Search/Aboutpredictiveanalytics
x11 removes seasonality whereas predict provides forecasting for various levels (see algorithms http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Predict#Predict_options)

for either command, to look back further in your data, just set your period to a larger number. If you're looking at the last 30 data points right now, maybe expand to the last 60 data points while looking at the last 60 days?

In my opinion, these commands can be very helpful

0 Karma

kdimaria
Communicator

@cmerriman Thanks I've already seen those documents. The problem is that I only want to display the month (30 days or so) but be able to look at the last 60 days. I don't know if that's possible.

0 Karma

cmerriman
Super Champion

try adding |where _time>=relative_time(now(),"-30d@d") after the predict command. it should only show the last 30 days and future 30 days even if you look back 60, 100, etc. days.

kdimaria
Communicator

Thank you I think this is what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...