Splunk Search

Loop on the values of a column of a table

silverdiver
New Member

Hello,
I have the following SPL command :

 

|tstats count where index=main host IN (H1,H2) by host, _time span=1h | predict "count" as prediction algorithm=LLP holdback=168 future_timespan=240 period=168 upper90=upper90 lower90=lower90 | `forecastviz(240, 168, "count", 90)` |

 

It makes predictions about the count of a host
It outputs an array of the type :

 

host | _time | count | lower90(prediction) | prediction | upper90(prediction)
H1 | 2021-07-10 00:00 | 6170671 | 2494994.26372 | 6170671.0 | 9846347.73628
H1 | 2021-07-10 01:00 | 6231397 | 2456899.6988 | 6231397.0 | 10005894.3012
.
.
.
H2 | 2021-07-10 05:00 | 5216984 | 1722288.55477 | 5216984.0 | 8711679.44523
H2 | 2021-07-10 06:00 | 5297360 | 1979214.14187 | 5297360.0 | 8615505.85813
.
.
.

 


I would like to calculate linear regressions for each host in this table with the MLTK macro

 

`regressionstatistics("count", prediction)`

 

to outpuy an array of type :

 

host | rSquared | RMSE
H1 | 0.8042 | 1195199.83
H2 | 0.7842 | 1126684.87

 

I can't do it.

Could you help me?


Thanks in advance
Sincerely

M.

Labels (1)
0 Karma

silverdiver
New Member

Does anyone have an idea?

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...