Splunk Search

Whats the difference between the machine learning toolkit>forecast and the predict command you can run at searchtime?

Communicator

Whats the difference between the machine learning toolkit>forecast and the predict command you can run at searchtime?

0 Karma

Splunk Employee
Splunk Employee

Let me step back and start from your first question:

  • Predict command != Predictions
  • Predict command only does forecasting using different modes of Kalman filter on a single value over time
  • It does not create or save models
  • Currently you cannot do this with predict command and everytime you have to run the entire search to do the forecasting

Communicator

Predictions seem to be one thing, I was kinda hoping the machine learning part of Splunk actually learns over time as the predict command just seems to predict based on past events.

Would be nice to see what Splunk has learnt and what it’s adjusting based upon those learnings if it is actual machine learning with the toolkit

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee

Both are based on Kalman Filter algorithms but the Machine Learning Toolkit has an additional algorithm called ARIMA and MLTK forecast also has a UI interface to show the predicted values, its accuracy, error rate and more in the UI itself.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!