Prediction with X-Axis in Visualization When Input Data is Already Bucketed Hourly

[j_williams]

Hello,

Question first: How can I output an hourly prediction chart with the actuals and predicted values when the _time values are already bucketed by hour in the input data source?

I am running a prediction against the output of a scheduled report (optimizes on time). Prediction runs fine, output looks good, except the x-axis is missing.

The report I am inputting data from already has values bucketed in to hours. looks similar to this:
index=summary report=reporty.report

_time count
2016-03-30 13:00:00 555
2016-03-30 12:00:00 555
2016-03-30 11:00:00 555
2016-03-30 10:00:00 555
2016-03-30 09:00:00 555
2016-03-30 08:00:00 555

From that report, i then run prediction and output a line chart. Normally, to get the axis I would do something like
| timechart span=1h count | sort _time asc
However, with the hour buckets already aggregated, this does not show the correct values. Almost looks like it normalizes them instead of showing the raw values.

Thanks,

-J

[j_williams · Accepted solution]

Answer from martin_mueller:

"If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value."

[martin_mueller]

Remove the sort and try again.

If your summary index contains a count field, replace | timechart count with | timechart sum(count) as count - else it'll always count events instead of using the pre-aggregated value.

[j_williams]

Awesome, this worked. Looks great too 🙂

index=summary report=reporty.report
| timechart span=1h sum(count) as count
| predict count period=24 future_timespan=24 algorithm=LLP lower50=(Lower50) upper95=(Upper95)