Splunk Search

Prediction with X-Axis in Visualization When Input Data is Already Bucketed Hourly

j_williams
Explorer

Hello,

Question first: How can I output an hourly prediction chart with the actuals and predicted values when the _time values are already bucketed by hour in the input data source?

I am running a prediction against the output of a scheduled report (optimizes on time). Prediction runs fine, output looks good, except the x-axis is missing.

The report I am inputting data from already has values bucketed in to hours. looks similar to this:
index=summary report=reporty.report

_time count
2016-03-30 13:00:00 555
2016-03-30 12:00:00 555
2016-03-30 11:00:00 555
2016-03-30 10:00:00 555
2016-03-30 09:00:00 555
2016-03-30 08:00:00 555

From that report, i then run prediction and output a line chart. Normally, to get the axis I would do something like
| timechart span=1h count | sort _time asc
However, with the hour buckets already aggregated, this does not show the correct values. Almost looks like it normalizes them instead of showing the raw values.

Thanks,

-J

Tags (1)
0 Karma
1 Solution

j_williams
Explorer

Answer from martin_mueller:

"If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value."

View solution in original post

j_williams
Explorer

Answer from martin_mueller:

"If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value."

martin_mueller
SplunkTrust
SplunkTrust

Remove the sort and try again.

If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value.

0 Karma

j_williams
Explorer

Awesome, this worked. Looks great too :slightly_smiling_face:

index=summary report=reporty.report
| timechart span=1h sum(count) as count
| predict count period=24 future_timespan=24 algorithm=LLP lower50=(Lower50) upper95=(Upper95)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...