Getting Data In

How would I use my own data on Splunk Free with ML Toolkit?

arianalema
New Member

Hi,

I am using the below for data that I have uploaded and I get 0 events. When I go to datasets/tables, I see this dataset. Why does it not work when I call it within the ML Toolkit? Thanks!
| inputlookup weeklyTrends-sundayGrowthUnderlying.csv

0 Karma

adonio
Ultra Champion

check permissions on your lookup maybe.
if you added it via GUI, its probably has private permissions, as this is the default.
click in settings, top right corner -> lookups -> Lookup Table Files -> find your file -> scroll to the right -> hit permissions -> change to global (all apps) -> save

hope it helps

0 Karma

arianalema
New Member

Hi,
That did give me access but in Kalman Filter I get "External search command 'predict' returned error code 1."
Do you have any idea as to why this would come up? It once showed me the results in a flash then took them away and popped up this error.
Code:
* source="weeklyTrends-growthUnderlying (1).csv" | predict "value" as prediction algorithm=LLP5 holdback=10000 future_timespan=10005 upper95=upper95 lower95=lower95 | forecastviz(10005, 10000, "value", 95)

Thanks again!

EDIT: It works with a smaller dataset but I get the error after ~10k observations only.

0 Karma

Sukisen1981
Champion

hmmm interesting , now holback is as per the definition
holdbackSyntax: holdback=Description: Specifies the number of data points from the end that are not to be used by the predict command. Use in conjunction with the future_timespan argument. For example, 'holdback=10 future_timespan=10' computes the predicted values for the last 10 values in the data set. You can then judge how accurate the predictions are by checking whether the actual data point values fall into the predicted confidence intervals. Default: 0
So, what I am not getting is if you have a data set of 10K observations AND you holdback the entire 10k as shown here , then what are you basing the prediction upon?
if i modify your query to something like * source="weeklyTrends-growthUnderlying (1).csv" | predict "value" as prediction algorithm=LLP5 holdback=1000 future_timespan=1000 upper95=upper95 lower95=lower95 | forecastviz(10005, 10000, "value", 95)
Does it work?

0 Karma

adonio
Ultra Champion

this has to do with limits settings, i dont have it top of my head but i am positive a quick search will give you the answer. will look for it later

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...