Splunk Search

Exponential Smoothing Implementation in Splunk

samsplunkd
Path Finder

Hi,

I am planning to implement exponential smoothing in Splunk based on below formula where
s1 is the forecasted value. At time t=0, it is equal to first event. For time=t, it is calculated based on below formula. I can hard code value for "alpha".

s1=x0
s{t}=[alpha * x{t-1}] + [(1-alpha)s{t-1}], t>1

For time=t, it is referring to previously calculated forecast value (s{t-1}) and previous event value (x{t-1}) so not sure how this can be achieved using Splunk.
Say the log data is like below and "total" is the field which needs to be used(x{t}) to calcuate forecasted value(s{t}). I know there will be a field named "total" created which contains all the values but is there a way I can refer to say first value in field "total" like total0 which will be equal to 4, total[1] which will be equal to 6?

1/2/13 2:30:00.000 PM total=4
1/2/13 2:31:00.000 PM total=6
1/2/13 2:32:00.000 PM total=8
1/2/13 2:33:00.000 PM total=10

Any help is greatly appreciated.

0 Karma

jonuwz
Influencer

The trick here is to make all the data required for the calculation in the current event.

Looking at the formula, it only relies on the previous value of x and the previous value of s.

You can pull the previous value of a field into the current event like this :

... | streamstats window=1 current=f total as prev_total

so now you have access to x{t} and x{t-1} in the event. ( total and prev_total fields respectively)

You'll also need to pre-populat the 1st valid value of s, then you can use the above method to 'stream' the previous value of s into the current event to calculate s{t}

yannK
Splunk Employee
Splunk Employee

To do a cumulative total in a new field, take a look at the function eventstats.
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Eventstats

and maybe too at the function predict that may already do what you want.
http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/Predict

0 Karma

samsplunkd
Path Finder

Thanks for the reply But my requirement is little different. This formula expects values from previous calculated results so I would like to know if there is a way I can refer to field values separately like arrays as specified in my question above.

s{t}=[alpha * x{t-1}] + [(1-alpha)s{t-1}], t>1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...