Either your _time or EXEC could be in float format which needs to be changed to the integer type. Could you show the table for _time and EXEC just before the fit ARIMA command? ... View more

Both are based on Kalman Filter algorithms but the Machine Learning Toolkit has an additional algorithm called ARIMA and MLTK forecast also has a UI interface to show the predicted values, its accuracy, error rate and more in the UI itself. ... View more

As per your comment your prediction accuracy for bad is low but in the table shared, it seems like for actual bad values your predicted bad accuracy is 88.1% which seems great and for prediction of good it's 19.4% accurate which is not a good prediction accuracy. Seems like table is inversed. Coming back to your problem of improving your accuracy of predicting bad , there are three options: 1) Getting more data for bad cases, this would help the model understand those cases more. Also, its possible that the fields being used for prediction do not have a good relation with the target variable, including new variables for prediction could also help. 2) Trying different algorithms. (Although RandomForestClassifier is a good one) 3) Using MLSPL API https://docs.splunk.com/Documentation/MLApp/4.0.0/API/Introduction , getting in the resampling algorithm into MLTK and using that to resample your data for Bad and Good to 50% each. Algorithm which can help: https://scikit-learn.org/stable/modules/generated/sklearn.utils.resample.html https://scikit-learn.org/stable/modules/generated/sklearn.model_selection.StratifiedKFold.html Hope this helps. ... View more

If you trying to find common patterns in numerical fields then you can use Correlation Matrix algorithms on your whole dataset consisting of only numerical values to find relations between them. This algorithms is not already available in MLTK but is very easy to implement using ML-SPL API as the code for the algorithms is already written and you just have to put it in your app files. Link for ML-API : http://docs.splunk.com/Documentation/MLApp/4.0.0/API/Introduction. And Link for the pre-written algorithm: http://docs.splunk.com/Documentation/MLApp/4.0.0/API/CorrelationMatrix . Hope this helps , if this is not what you were looking for let us know. ... View more

Kernel parameter is not exposed for SVM algorithm (set to rbf) in MLTK but if you want to use Linear Kernel, you can implement that algorithm into MLTK using ML-SPL API http://docs.splunk.com/Documentation/MLApp/4.0.0/API/Introduction. There are examples of how to bring in new algorithms into MLTK in our MLTK GitHub Repo : https://github.com/splunk/mltk-algo-contrib. ... View more

If you trying to increase the maximum no. of events that your algorithms can handle then you can change in the mlspl.conf file or if you have MLTK 4.0 installed then you can do it directly from the menu panel by clicking on the settings tab in MLTK. ... View more