Predict by

[Parameshwara]

My search result:

_time                       Location    Total
01/01/13 12:00:00.000 AM    Location 1  12
02/01/13 12:00:00.000 AM    Location 1  15
03/01/13 12:00:00.000 AM    Location 1  10
04/01/13 12:00:00.000 AM    Location 1  19
05/01/13 12:00:00.000 AM    Location 1  15
01/01/13 12:00:00.000 AM    Location 2  2
02/01/13 12:00:00.000 AM    Location 2  2
03/01/13 12:00:00.000 AM    Location 2  3
04/01/13 12:00:00.000 AM    Location 2  5
05/01/13 12:00:00.000 AM    Location 2  2
01/01/13 12:00:00.000 AM    Location 3  35
02/01/13 12:00:00.000 AM    Location 3  35
03/01/13 12:00:00.000 AM    Location 3  39
04/01/13 12:00:00.000 AM    Location 3  25
05/01/13 12:00:00.000 AM    Location 3  30

Is it possible to use predict, for the Total field by Location?

[akastulin]

I think there is a better option. You can use subsearch in predict command that will dynamically generate the list of fields to predict. Using Splunk tutorial data, i.e counting events based on status code and predicting it:
index="tutorial" sourcetype=access_combined_wcookie | timechart count by status | predict [search index="tutorial" sourcetype=access_combined_wcookie | stats values(status) as status | eval status=mvjoin(status, ", ") | rename status as search]

subsearch
search index="tutorial" sourcetype=access_combined_wcookie | stats values(status) as status | eval status=mvjoin(status, ", ") | rename status as search

will generate list of fields ( 200, 4004, 500,..) that predict command will take an generate prediction from.
Just an idea....

[David]

Providing a clearer example for gwobben's example above, as of 6.4 you can do:

... your search string | timechart sum(Total) by Location | rename "Location *" as Location* | predict Location1 Location2 Location3

[gwobben]

Sorry, you cannot do that. Predict has no "by" clause, like stats, which makes it impossible to make multiple predictions.

HOWEVER

If you really need to, and don't really care for performance, you could use the map command to do something like:

... your search resulting in a list of Locations ... | map [search location=$location$ | timechart something | predict Total]

The map command will loop all of your locations and execute predict for each of them. Then it will append the results of each run to the final results. Just remember this has quite the performance impact because you'll be starting a new search for each location.

As an alternative you might consider user the R app, which is currently only available on github: https://github.com/rfsp/r. This app will allow you to run R commands in Splunk, and R is able to make multiple predictions at a time.

====

EDIT

The predict function now takes multiple fields, starting of version 6.3.4! Just make a timechart by something and add:

| predict <fields you want to predict>

[mtmoore]

I also want to know if this possible. Being able to predict on one piece of data only is very limiting..

[HattrickNZ]

I don't know but what I have come to conclude is that you can only do by 1 location at a time, so you have to filter out the others before doing your predict.

It probably isn't what you want but 1 prediction graph per location might be clearer to the end user, as with 3 predictions in one graph would be very unclear, unless you could turn different locations on/off as you wish.