Facing exactly same issue, any other solution rather than downgrading the version ? ... View more

Thanks, So CIM app will be deployed normally using deployer and rest config i will do via GUI and it will be replicated to SHC members. That means SHC members will have more updated config done via GUI in CIM app then we had in CIM app in deployer originally. SHC members will have the GUI updated config in local folder of the app which won't be affected when in future we may upgrade the CIM app from deployer to SHC. Hope this understanding is correct ? ... View more

Hi, Thanks for response, Yes, we have 3 search members in SHC and 3 indexers in Indexer Cluster. Search Heads are forwarding their logs to indexers. Yes, have gone through this https://docs.splunk.com/Documentation/CIM/5.0.0/User/Install  but unable to find how to setup CIM in SHC environment. I can push CIM app using deployer to SHC, how to configure it (via GUI of SH(SH are behind LB) or configure CIM app in deployer and push to SHC) ? ... View more

Can anyone help with the above query ? ... View more

Hi sukisen, When you say you are getting CPU utilization prediction using given below factors:- "the factors I have chosen is something like this : cpu util = K + A(no. of log ins) + b(no. of concurrent log ins) + c (no.of stuck threads) + d(no.of calls to a particular link within the application that we knew was a major overhead)..." you are getting these results using random forest regressor, are you forecasting the cpu utilization as well ? If yes, then have you used random forest regressor and kalman filter together ? i main motive is to forecast the CPU utilization based on similar factors you used ? but i am not sure how to forecast the predicted results ? hope to get some help on this from you. ... View more

Hi, Yes, the max, min, sum, average are from different server, Its like i am collecting data of compete web layer of our application (assume 20-30 web servers), and trying to predict average cpu utilization for web layer. Using only kalman filter :- index=main sourcetype=xyz metric_name=CPUUtilization EnvCategory="WEB" | table _time, "Average" | timechart span=15m avg(Average) | predict "avg(Average)" as prediction algorithm="LLP5" future_timespan="3" holdback="0" lower"50"=lower"50" upper"50"=upper"50" | forecastviz(3, 0, "avg(Average)", 50) Using both Linera regression and kalman together:- index=main sourcetype=xyz metric_name=CPUUtilization EnvCategory="WEB" | apply "Predict_CPUUtilization" | table _time, "Average", "predicted(Average)" | rename predicted(Average) as Avrg | timechart span=15m avg(Avrg) | predict "avg(Avrg)" as prediction algorithm="LLP5" future_timespan="3" holdback="0" lower"50"=lower"50" upper"50"=upper"50" | forecastviz(3, 0, "avg(Avrg)", 50) I am getting exactly similar prediction forecast for both above scenarios. hmm, does it mean only kalman filter results i am getting in both case. I will try to find the dependent variables for the web layer and will use them to see what difference i will get. ... View more

Hi, I might be doing many things wrong here but want to make it correct with the help of all of you, Thanks for the responses. I have removed Average>2 and build the model again using Linear Regression, I am predicting CPU Average Utilization and using few fields to help predict "Average" field, helping fields are "Max", "Min", "Sum" , "_time" where max , min and sum are cpu values coming from source index=main sourcetype=xyz metric_name=CPUUtilization | where EnvCategory="WEB" | apply "Predict_CPUUtilization" I am getting R^2 as 1 and RMSE as 0. Please check below images for reference:- https://s3.amazonaws.com/predimages/Fitting-model-snap-1.JPG https://s3.amazonaws.com/predimages/Fitting-model-snap-2.JPG Then I am adding model to forecast Predicted Average using kalman filter with LLP5 Method :- index=main sourcetype=xyz metric_name=CPUUtilization | where EnvCategory="WEB" | apply "Predict_CPUUtilization" | table _time, "Average", "predicted(Average)" | rename predicted(Average) as Avrg | timechart span=5m avg(Avrg) | predict "avg(Avrg)" as prediction algorithm="LLP5" future_timespan="3" holdback="0" lower"50"=lower"50" upper"50"=upper"50" | forecastviz(3, 0, "avg(Avrg)", 50) getting R^2 as 1 and RMSE as 0.01 Please check below Images for reference:- https://s3.amazonaws.com/predimages/Forecasting-1.JPG https://s3.amazonaws.com/predimages/Forecasting-2.JPG Please check and let me know what correction is needed. Thanks! ... View more

Hi, My Linear regression model R^2 value is coming as 1 which means its perfectly predicting the field, now to predict it for future 5 or 10 mins what do i need to to ? As mentioned in MLTK, Linear regression is used to detect anomaly if there is big difference in the original field value and predicted field value. I am not getting anomaly and getting 100% matching predicted results, now to predict it for future 5 or 10 mins, do i need to use predict command (which uses kalman filter) in backend ? In my original query "predicted(Average)" is the output field of linear regression with predicted values, now to forecast it for future time i am transforming it to time series data and then using forecast using kalman filter ? is this correct ? or i can predict the "predicted(Average)" values for future time without using kalman filter ? Linear regression query using prediction model :- index=main sourcetype=cpumetric metric_name=CPUUtilization Environment="WEB" Average>2.00 | apply "Predict_CPUUtilization" | table _time, "Average", "predicted(Average)" Added below query to get forecast :- | rename predicted(Average) as Avrg | timechart span=15m avg(Avrg) | predict "avg(Avrg)" as prediction algorithm="LLP5" future_timespan="3" holdback="0" lower"50"=lower"50" upper"50"=upper"50" | `forecastviz(3, 0, "avg(Avrg)", 50) ... View more

Hi, Corrected ... View more

I have downgraded to splunk version 6.6.1 and using MLTK 2.3.0 now and all queries working fine now. Using Splunk Enterprise on RHEL Instance. Thanks! ... View more

Hi, No, this query is running fine on 6.5.5 only and getting the error code 1 on 6.6.3. I am using MLTK 2.3.0 on 6.6.3 splunk. ... View more

Hi, index=predict sourcetype=anktest | search busy!=null | timechart count(eval(busy>500)) AS critical | predict "critical" as prediction algorithm="LLP" future_timespan="15" holdback="0" lower"95"=lower"95" upper"95"=upper"95" | `forecastviz(15, 0, "critical", 95)` After running the above query i am getting same error, i am using splunk version 6.6.3, whereas when i am running below query on splunk version 6.5.5 where MLTK app is not installed, it is running fine and giving me results. index=predict sourcetype=anktest | search busy!=null | timechart count(eval(busy>500)) AS critical | predict "critical" as prediction algorithm="LLP" future_timespan="15" holdback="0" lower"95"=lower"95" upper"95"=upper"95" The only difference between above two queries are below :- different versions, one is having MLTK installed and other do not have MLTK | forecastviz(15, 0, "critical", 95) this string is not used where MLTK is not installed. What is wrong here ? ... View more

Hi Niket, Thanks for the post, I am using timechart in my query to generate time series data and then applying predict but still getting same error. Reduced query as below :- index=predict sourcetype=anktest | search wcsbusy!=null | timechart count(eval(wcsbusy>500)) as critical | predict "critical" as prediction algorithm="LLP" future_timespan="15" holdback="0" lower"95"=lower"95" upper"95"=upper"95" | `forecastviz(15, 0, "critical", 95)` Getting same error :- External search command 'predict' returned error code 1. ... View more

Hi All/Rich, Tried timewrap, but not getting required result. Please find the complete search I am using below for getting consecutive time Success Percentage. index=xxx sourcetype=abcd earliest=-20m latest=now | stats count(eval(STATUSCODE="ERROR" OR STATUSCODE="COMPLETE" OR STATUSCODE="COMPLETED")) as "RequestCount", count(eval(STATUSCODE="COMPLETE" or STATUSCODE ="COMPLETED")) as "SuccessCount", count(eval(STATUSCODE="ERROR")) as "ErrorCount" by ID COMPONENT | eval Result=round(((SuccessCount)/RequestCount)*100,2)." %" | appendcols [ search index=xxx sourcetype=abcd earliest=-10m latest=now | stats count(eval(STATUSCODE="ERROR" OR STATUSCODE="COMPLETE" OR STATUSCODE="COMPLETED")) as "RequestCountlatest", count(eval(STATUSCODE="COMPLETE" or STATUSCODE="COMPLETED")) as "SuccessCountlatest", count(eval(STATUSCODE="ERROR")) as "ErrorCountlatest" by ID COMPONENT ] | eval LatestResult=round(((SuccessCountlatest)/RequestCountlatest)*100,2)." %" | table ID COMPONENT SuccessCount ErrorCount RequestCount SuccessCountlatest ErrorCountlatest RequestCountlatest Result LatestResult | fillnull value=0 As you see, the main search runs between -20 to now time duration and subsearch runs between -10 to now time duration. Surprisingly, I am getting some data in subsearch columns which I am not getting in main search columns. I want Result and latestResult column data in respect to ID and COMPONENT for the respective duration. For example: If ID has A value and COMPONENT has B value in subsearch timeframe and showing percentage result in LatestResult column, then I should get the same or more value in main search timeframe as subsearch time frame falls under main search timeframe. Basically, I need consecutive 10min time SuccessPercentage with respect to ID and Component. Please help to get the required result. Thanks!!!! ... View more