We are returning the coefficients provided by scikit-learn, specifically the .coef_ attribute, as documented here: http://scikit-learn.org/stable/modules/generated/sklearn.linear_model.LinearRegression.html You can inspect the code directly in the MLTK directory under ml-spl/bin/algos/LinearRegression.py ... View more

If you're asking whether the output of one model (load_model that produces 'predicted(load)') could be used as a predictor of another model (end_model that produces 'predicted(end)'), then yes, you can! [your load data] | fit load from ... into load_model [your end data] | apply load_model | fit end from "predicted(load)" ... into end_model [your new data] | apply load_model | apply end_model Note that "your end data" must include the fields used by load_model (minus load), and "your new data" must include both those fields and the fields used by end_model (minus end). ... View more

This questions is impossible to answer well without knowing more about the data, but here are a few suggestions based on what you've provided: Predict delay (the difference between scheduled and start time) rather than start time. Use derived features of the scheduled time (like hour or day of the week) in addition to the epoch time. Try different algorithms, including random forest, and see which works best. If you stick with the defaults in the Toolkit, you only need to run the assistant a handful of times. Think about what you want from this model. If minimal RMSE is your goal, #3 is sufficient. If you want an interpretable model that tells you what features are important, for example, some models are better choices than others (models that support the summary command will be automatically summarized at the bottom of the assistant). ... View more

Hi there, Some algorithms support an argument called "partial_fit" that allows you to update an existing model. Quoting from the docs: "The partial_fit parameter controls whether an existing model should be incrementally updated or not (default is "false"). This allows you to update an existing model using only new data without having to retrain it on the full training data set. Example using partial_fit: | inputlookup iris.csv | fit GaussianNB species from * partial_fit=true into My_Incremental_Model In the example above, if My_Incremental_Model does not exist, the model is saved to it. If My_Incremental_Model exists and was trained using GaussianNB, the command updates the existing model with the new input. If My_Incremental_Model exists but was not trained by GaussianNB, an error message will be given. If partial_fit=false or partial_fit is not specified (default is false), the model specified is created and replaces the pre-trained model if one exists." You can search for "partial_fit" on the following page to see which algorithms support it: http://docs.splunk.com/Documentation/MLApp/3.2.0/User/Algorithms ... View more

Without knowing more about the data, I'd suggest two directions for investigation: If you expect the number of past occurrences of an error to be a good predictor of future occurrences, try using the Forecast Time Series assistant. For example, web server traffic from one day to the next may be fairly predictable on an hour-to-hour basis, so perhaps the number of errors is, as well. If you expect environmental factors like free disk space or CPU utilization to play a role in the occurrence of the errors, try using the Predict Numeric Fields assistant to build a model that takes those factors, now, and tries to predict the number of errors in, say, an hour. ... View more

Hi Chandana, Could you please say more about what's missing in the documentation? For example, the anomalydetection command docs say that it "identifies anomalous events by computing a probability for each event and then detecting unusually small probabilities. The probability is defined as the product of the frequencies of each individual field value in the event." It then goes on to explain how those field value probabilities are computed. So, if you have two fields, A="blue" and B=7, where A has the value "blue" 25% of the time and B has a histogram of values such that the bin containing 7 is 10% of the mass of the histogram, then the probability of the event would be p = 0.25 * 0.1 = 0.025. Does that make sense? Is it not behaving as expected? Cheers, - Adam ... View more