Hello, I just encounter a problem in fit and apply StateSpace Forecast algorithm in MLTK. I can fit and save a model, but when I apply the saved model it doesn't work: it doesn't return an error, but it doesn't show the value of prediction.  It just happens in StateSpace and not in another algorithms. I didn't find anything in documentation. I'm afraid is it a problem in new version of MLTK? our internal problem??   Thanks Maryam ... View more

  Hello Splunk community, I hope that your experience with Splunk can help me. Actually, I'm working on making an alert. The case is putting an alert on the "server message rate". And the goal is to put an alert on the moving thresholds. I did a prediction (LLP5) and generated the upper and lower bound, then i put an alert on it. There are few points to be mentioned: 1- we have data just from 2nd of Dec 2020 (less than 2 months), 2- we saw a behaviour that alerts of this week are not anymore alerts when we run the query the next week. Some questions:  1- Can LLP5/LLP be the best possible MLTK algorithm to try when we wanna make alerts? I treid StateSpace Forecast and DecisionTreeRegressor as well, but in these algorithms, we should create lower and upper bounds ourselves. 2- Can we create alerts on the base of comparing week by week data? Prediction week by week and then comparing for example Mondays, Tuesdays, etc. with each other. Normally I know that it's possible, but in prediction and alerting I don't know. 3- Is it normal that an alert that we saw last week, this week gets disappeared? Does it mean, that data learns from the historical data, then an alert of last week can get disappeared this week? 4- In MLTK, In the time picker, when i choose 30 days in relative time, the result is different from the preset 30 dayst, why?? It's weird for me.  5- Finally, less than 2 months data, is it enough? The simplified query is as follows: | tstats sum(msg) as msg where `sws_logs_indexes` sourcetype=sws* host="p*" mp_name="xxx" sag_instance="*xxx" by _time sag_instance span=10m | streamstats current=false latest(msg) as previous_msg by sag_instance | eval rate=msg-previous_msg | timechart span=10m avg(rate) as "Server msg rate" | predict "Server msg rate" as prediction algorithm=LLP5 holdback=0 future_timespan=0 upper75=upper75 lower75=lower75 | eval isOutlier = if(prediction!="" AND 'Server msg rate' != "" AND ('Server msg rate' < 'lower75(prediction)' OR 'Server msg rate' > 'upper75(prediction)'), 1, 0) | table _time,isOutlier |where isOutlier=1   Thanks in advance, Kind regards, Maryam        ... View more

Hello Splunk community, I need to do one prediction for two different time ranges in different span in one report. The objective is making alert on the prediction of rate of messages: 1- from 5 am to10pm (span=10min) and 2- from 10pm to 5am (span=20 min). It can be really easy, but as I'm new to Splunk, I couldn't find a proper way for it. My base query is: |tstats latest(msg) as msg where `sws_logs_indexes` sourcetype=sws:sag:msgpartners host="p*" mp_name="Bessserver*" sag_instance="*SAG12" by _time sag_instance mp_name span=10m | stats sum(msg) as msg by _time sag_instance | streamstats current=false latest(msg) as previous_msg by sag_instance | eval rate=msg-previous_msg | timechart span=10m avg(rate) as "Server msg rate" | predict "Server msg rate" as prediction algorithm=LLP5 holdback=0 future_timespan=0 period=1008 upper75=upper75 lower75=lower75 |`forecastviz(24, 0, "Server msg rate", 75)` | eval isOutlier = if(prediction!="" AND 'Server msg rate' != "" AND ('Server msg rate' < 'lower75(prediction)' OR 'Server msg rate' > 'upper75(prediction)'), 1, 0) | where isOutlier=1 |table _time,isOutlier ... View more