Splunk has 100s of apps that extends its core capabilities.
The Machine Learning Toolkit App delivers new ML specific search commands, visualizations,
and other tools for performing machine learning to your Splunk data.
In addition to all this, we have ML Assistants that guide you through the process of building
custom models and operationalizing them on the Splunk Platform.
In this video, we’ll explore the “Forecast Time Series” assistant, which helps us forecast
future values of a metric using past values.
Forecasting is a type of prediction, where we are trying to predict future values from
past values.
Note that most of the input and output panels in this assistant have tooltips, giving us
more information about the particular panel.
Hover over a panel title or field label to reveal these tooltips.
In this example, we will forecast the internet traffic for better planning of resource allocation.
Using the search field, we first load the Internet Traffic dataset that is packaged
with the app.
After clicking the search button, we get the “Raw Data Preview” panel below, which
shows us the bit transferred field over time.
The time gap between each bit count currently is 5 min, but we don’t want that much granularity
in our data so we can take the average of bit transferred over 120 min time span.
The transformed data replaces 24 points with 1 average point.
We did this because we had 2-3 months’ data and every five mins data would make our processing
heavy without giving any drastic change in results.
After transformation, we first set the ‘bits_transferred’ field as Field to forecast.
Next we select one of the methods for forecasting.
We will be using LLP5 method for our example.
This method is the mix of LLP and LLT, where both seasonal and trend patterns are used
for forecasting.
We are using this method because our data contains some trend patterns and it is also
represented over time, so seasonal patterns could also be there.
Once we are done with the selection of method, set the no. of points to be used for testing
our forecasting setup and then the no. of points to be forecasted in future.
(callout in recording)
Next, we have the option to select the confidence interval and the common choice for this field
is 95%.
Selecting a confidence interval is a more elaborate process which depends on the use
case and characteristics of the data that are beyond the scope of this video.
Lastly, we have the optional setting for period which is used in case of periodic dataset
such as monthly or annually generated data which we don’t have so we will leave this
panel unselected.
Clicking the forecast button computes a forecast for the specified field.
To evaluate how well the test data has been forecasted, the assistant automatically generates
a visualization and computes some test statistics using the withhold set.
Forecast Visualizations shows the metric, the forecast and the confidence envelope.
This plot is divided into three parts, training, withholding and forecasted.
The training part of the visualization shows the tight envelope around the actual values
of network traffic; the predicted values are similar to the actual values.
Next is the withheld data, where we are testing our forecasting algorithm, we know both the
forecasted values and the actual values.
This portion of the data is also used to compute validation statistics like R^2 and RMSE.
Finally, we have the Forecast, where we don’t have the actual value to compare against.
The uncertainty as we forecast further into the future is reflected in the larger confidence
envelope.
The Forecast Outliers panel shows the no. of outliers detected in the forecasted data,
meaning values that fell outside the confidence bounds.
These outliers could also be plotted over time using the ‘Plot Outliers Over Time’
button.
On the “Load Existing Settings” tab we can compare different setups used for detecting
outliers using statistics such as R-Square and Root Mean Squared Error, etc. and reload
the one that worked best.
These results are then forwarded to an IT Admin who can further balance the system resources
based on the forecasted traffic data and minimizing the chances of highly over loaded or under
loaded server.
We can also apply our configuration to new data.
These assistants not only walk you through the steps required to forecast a field, but
all of these tools can be reused and provide a variety of options for operationalizing
this setup.
You can view the SPL commands used at every step, create alerts based on the output generated
or use one of the validation panels on your own dashboard.
To learn more about the Machine Learning Toolkit, including the other Assistants, browse through
our ML videos.