Splunk Search

Predict by

Parameshwara
Path Finder

My search result:

_time                       Location    Total
01/01/13 12:00:00.000 AM    Location 1  12
02/01/13 12:00:00.000 AM    Location 1  15
03/01/13 12:00:00.000 AM    Location 1  10
04/01/13 12:00:00.000 AM    Location 1  19
05/01/13 12:00:00.000 AM    Location 1  15
01/01/13 12:00:00.000 AM    Location 2  2
02/01/13 12:00:00.000 AM    Location 2  2
03/01/13 12:00:00.000 AM    Location 2  3
04/01/13 12:00:00.000 AM    Location 2  5
05/01/13 12:00:00.000 AM    Location 2  2
01/01/13 12:00:00.000 AM    Location 3  35
02/01/13 12:00:00.000 AM    Location 3  35
03/01/13 12:00:00.000 AM    Location 3  39
04/01/13 12:00:00.000 AM    Location 3  25
05/01/13 12:00:00.000 AM    Location 3  30

Is it possible to use predict, for the Total field by Location?

0 Karma

akastulin
Splunk Employee
Splunk Employee

I think there is a better option. You can use subsearch in predict command that will dynamically generate the list of fields to predict. Using Splunk tutorial data, i.e counting events based on status code and predicting it:
index="tutorial" sourcetype=access_combined_wcookie | timechart count by status | predict [search index="tutorial" sourcetype=access_combined_wcookie | stats values(status) as status | eval status=mvjoin(status, ", ") | rename status as search]

subsearch
search index="tutorial" sourcetype=access_combined_wcookie | stats values(status) as status | eval status=mvjoin(status, ", ") | rename status as search

will generate list of fields ( 200, 4004, 500,..) that predict command will take an generate prediction from.
Just an idea....

0 Karma

David
Splunk Employee
Splunk Employee

Providing a clearer example for gwobben's example above, as of 6.4 you can do:

... your search string | timechart sum(Total) by Location | rename "Location *" as Location* | predict Location1 Location2 Location3
0 Karma

gwobben
Communicator

Sorry, you cannot do that. Predict has no "by" clause, like stats, which makes it impossible to make multiple predictions.

HOWEVER

If you really need to, and don't really care for performance, you could use the map command to do something like:

... your search resulting in a list of Locations ... | map [search location=$location$ | timechart something | predict Total]

The map command will loop all of your locations and execute predict for each of them. Then it will append the results of each run to the final results. Just remember this has quite the performance impact because you'll be starting a new search for each location.

As an alternative you might consider user the R app, which is currently only available on github: https://github.com/rfsp/r. This app will allow you to run R commands in Splunk, and R is able to make multiple predictions at a time.

====

EDIT

The predict function now takes multiple fields, starting of version 6.3.4! Just make a timechart by something and add:

| predict <fields you want to predict>

mtmoore
Explorer

I also want to know if this possible. Being able to predict on one piece of data only is very limiting..

0 Karma

HattrickNZ
Motivator

I don't know but what I have come to conclude is that you can only do by 1 location at a time, so you have to filter out the others before doing your predict.

It probably isn't what you want but 1 prediction graph per location might be clearer to the end user, as with 3 predictions in one graph would be very unclear, unless you could turn different locations on/off as you wish.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...