Activity Feed
- Posted Re: Integration of Prometheus with splunk on All Apps and Add-ons. 07-09-2020 06:49 PM
- Karma Re: Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? for grana_splunk. 06-05-2020 12:50 AM
- Karma Re: How to expand macros in a Splunk search? for yahuja_splunk. 06-05-2020 12:48 AM
- Karma Re: How to expand macros in a Splunk search? for anewell. 06-05-2020 12:48 AM
- Karma Re: How to combine my 2 reports? for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: How to pass multiple values from a drilldown in a table to a separate dashboard? for algalvan. 06-05-2020 12:47 AM
- Posted Re: Visualizations: Why is there a dot in my time chart graph? on Splunk Search. 12-01-2019 06:42 PM
- Posted Re: Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-17-2019 02:07 PM
- Posted Re: Should we expect deteriorated performance while applying a learned model compared with fit command ? on All Apps and Add-ons. 07-15-2019 01:40 PM
- Posted Should we expect deteriorated performance while applying a learned model compared with fit command ? on All Apps and Add-ons. 07-15-2019 01:26 PM
- Tagged Should we expect deteriorated performance while applying a learned model compared with fit command ? on All Apps and Add-ons. 07-15-2019 01:26 PM
- Tagged Should we expect deteriorated performance while applying a learned model compared with fit command ? on All Apps and Add-ons. 07-15-2019 01:26 PM
- Posted Re: Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-15-2019 10:24 AM
- Posted Re: Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-12-2019 05:22 AM
- Posted Re: Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-11-2019 12:58 PM
- Posted Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-11-2019 11:56 AM
- Tagged Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-11-2019 11:56 AM
- Tagged Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-11-2019 11:56 AM
- Tagged Splunk MLTK smartforecasting apply methods throws error "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." How to properly use the apply command and avoid the above error ? on All Apps and Add-ons. 07-11-2019 11:56 AM
- Posted Re: how to use makecontinuous in combination with stats to fill in time on Splunk Search. 07-11-2019 11:48 AM
Topics I've Started
07-09-2020
06:49 PM
I am really wondering why there is no Splunk supported procedure or an integration application to pull metrics from Prometheus. I see that this is a very important and useful use case with a number of instances I foresee in my company. So far that one app in Splunk base is the only answer I have got. Someone is not paying attention to the change in current. @Anonymous please do focus here.
... View more
12-01-2019
06:42 PM
I have similar issue and it is even worse
https://imgur.com/a/GHyXgU4
Any Idea how to fix this ?
... View more
07-17-2019
02:07 PM
Looks like adding the exact parameters like holdout and forecast along with feeding the data using time chart worked . Thanks Gyanendra.
... View more
07-15-2019
01:40 PM
I tried without specialdays input and specifying all the parameter necessary for apply method.
source="150daysAB - Copy.csv" host="forecast" index="150dayscopy" sourcetype="csv"
| reverse
| table _time Tput_Gbps Holiday_Flag | apply _150_AB3 holdback=0 forecast_k=384 conf_interval=95 period=96
| tail 500 | table _time predicted(Tput_Gbps) Tput_Gbps. It still gives me the same bad output
... View more
07-15-2019
01:26 PM
I am trying to forecast Tput_Gbps using smartforecasting . It works well when I fit the model . SPL: source="150daysABC - Copy.csv" host="forecast" index="150dayscopy" sourcetype="csv"
| reverse
| table _time Tput_Gbps Holiday_Flag | fit StateSpaceForecast "Tput_Gbps" as smartforecast output_metadata=true holdback=0 forecast_k=384 conf_interval=95 period=96 specialdays=Holiday_Flag into "_150_CD"
| tail 500 | table _time smartforecast Tput_Gbps
![alt text][1]
However, on the same data I tried to apply the model trained earlier. SPL: source="150daysABC - Copy.csv" host="forecast" index="150dayscopy" sourcetype="csv"
| reverse
| table _time Tput_Gbps Holiday_Flag | apply _150_CD
| tail 500 | table _time predicted(Tput_Gbps) Tput_Gbps
![alt text][2]
Towards the end of the prediction, I am seeing multiple predictions too. Looks very strange !! not sure how and why . Spent hours on troubleshooting this.
Please help to check if it is a bug or something that I am doing which is not right. @grana_splunk .This is in continuation to my earlier question. Thanks in advance for the help
... View more
07-15-2019
10:24 AM
Hi Grana.. It looks like a bug to me.. did the whole process again the apply command works. But when I reduce the number of days to it as input to the apply command, it gives me duplicate predictions (4 rows with different predicted values for the same time ) . Working on how to fix that now !!
... View more
07-12-2019
05:22 AM
Thanks.reverse is there to mitigate error while fitting the model. I removed the reverse command and tested. It gives me the same error
... View more
07-11-2019
12:58 PM
This is the error I am getting. "Error in 'apply' command: holdback value equates to too many events being withheld (96 >= 50)." Holdback is less than forecast_k . I even tried setting hold back to 0 . Regarding the table, there was a "star" after it which was removed somehow !!
Any idea what is the error about ?
... View more
07-11-2019
11:56 AM
I am using MLTK 4.3 Smartforecasting to model a time series . Forecasting works well with fit command . as soon as I try to use the model that was trained, it throws ambiguous errors(ambiguous to me ) . Search queries as below.
fit query:
source="119_AB_July10.csv" host="AB" index="july10" sourcetype="csv"| reverse | fit StateSpaceForecast "Tput_Gbps" output_metadata=true period=96 holdback=96 conf_interval=95 forecast_k=192 into "july11" | table *
apply query :
source="119_AB_July10.csv" host="AB" index="july10" sourcetype="csv"| reverse | apply july11 | table *
I think I am making some mistake somewhere. Please support.
... View more
07-11-2019
11:48 AM
Thanks . I used time chart to fix my issue currently . please let me know if your soln is different , I will start off a new thread .
... View more
07-05-2019
12:49 PM
Could you please elaborate your solution a bit ? I am faced with a similar issue where _time is discontinuous and MLTK throws error as I try to fit or apply model. TIA. FYI , I am quite new to Splunk but learning things fast.
... View more
