Splunk Search

Why is the predict command producing unexpected results with my current timechart search?

kishorksudha
Explorer

I have volumes that are ingested into Splunk for the past 6 months
Need to predict the volumes for the following period

-1 month
- 15 days
- 7 days
- 1 day
- 1 hour

I tried using the timechart with varying span (1h / 1d / 7d / 1w / 15d / 1mon) and the predict command.
The volumes were accurate enough for monthly prediction; but for weekly, daily, and hourly predictions, the values varied too much and the values were totally wrong.

for ex. I don't have any volumes at 00, 01, 02, and 03 hour on any particular day, but the predicted volume using the search:

index ...... | timechart span=1h Actual | predict Actual algorithm=LLP5

shows values at these hours. Not sure what I am doing wrong here

Can someone help me on this?

Richfez
SplunkTrust
SplunkTrust

My guess is that it's guessing the periods of the "seasonality" wrong. I'm no expert so I'm just guessing, but if you run it for the past week and are looking at an hour-by-hour, maybe adding period=7 may help? Check the predict docs for how to use it. Play around a bit, let us know what you find!

0 Karma

kishorksudha
Explorer

Thanks for the response,
I have tried using "period=7" before posting; it is not able to get the lows which is on saturday / sundays;

for ex, if the vols on Sat / Sun is as low as 10 and for the rest of the week it hovers around 200 on a hourly basis at peak period.
the predicted volumes show around 150 on Sat / Sun also.

Tried experimenting with LL LLP5 LLP LLT also , not successfull at getting one algorithm which fits all these

Thanks
Kishor

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...