Is the Splunk predict command useful?

[kdimaria]

So, I have a graph that shows the total user logins per day for an application and I thought it would be cool to show the ability to predict what the total number of logins for the next month would be. So the current graph just shows the previous month of total user log ins each day and when I use predict:

| predict Users period=30 future_timespan=30

It basically just mirrors the previous month to the future month since it is looking at the past 30 days. Is there a way to grab more "before" data than what I am displaying so that the predict doesn't just mirror the previous 30 days?

[cmerriman · Accepted solution]

You can read about two forecasting commands here (x11 and predict)
http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Search/Aboutpredictiveanalytics
x11 removes seasonality whereas predict provides forecasting for various levels (see algorithms http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Predict#Predict_options)

for either command, to look back further in your data, just set your period to a larger number. If you're looking at the last 30 data points right now, maybe expand to the last 60 data points while looking at the last 60 days?

In my opinion, these commands can be very helpful

[kdimaria]

@cmerriman Thanks I've already seen those documents. The problem is that I only want to display the month (30 days or so) but be able to look at the last 60 days. I don't know if that's possible.

[cmerriman]

try adding |where _time>=relative_time(now(),"-30d@d") after the predict command. it should only show the last 30 days and future 30 days even if you look back 60, 100, etc. days.

[kdimaria]

Thank you I think this is what I was looking for.