Splunk has hundreds of apps that extend its core capabilities.
The Machine Learning Toolkit App delivers new ML specific search commands, visualizations,
and other tools for performing machine learning to your Splunk data.
In addition, the application has ML Assistants that guide you through the process of building
custom models and operationalizing them on the Splunk Platform.
In this video, we’ll explore the “Forecast Time Series” assistant, which helps us forecast
future values of a metric using past values.
Forecasting is a type of prediction, where we are trying to predict future values from
past values.
Note that most of the input and output panels in this assistant have tooltips, giving us
more information about the particular panel.
Hover over a panel title or field label to reveal these tooltips.
In this example, we will forecast the no. of people joining a recurring event using
the historical counts of the number of bluetooth devices detected.
Using the search field, we first load the bluetooth dataset that is packaged with the
app.
After clicking the search button, we get the “Raw Data Preview” panel below, which
shows us the unique addresses of detected devices for multiple probes in the device.
We will filter out the bluetooth probe and count the no. of unique addresses over the
span of every 3 hrs. and save the count as ‘distinct_addresses’.
Next, we set the ‘distinct_addresses’ field as Field to forecast and select one
of the methods for forecasting.
We will be using LLP method for our example.
In this method the seasonal patterns of the data are taken into consideration during forecasting.
Once we are done with the selection of method, set the no. of points to be used for testing
our forecasting setup, and then the no. of points to be forecasted in future.
Next, we have the option to select the confidence interval and the common choice for this field
is 95%.
Selecting a confidence interval is a more elaborate process which depends on the use
case and characteristics of the data that are beyond the scope of this video.
Lastly, we have the optional setting for period which is used in case of periodic dataset
such as monthly or annually distributed data which we don’t have, so we will leave this
panel unselected.
Clicking the forecast button computes a forecast for the specified field.
To evaluate how well the test data has been forecasted, the assistant automatically generates
a visualization and computes some test statistics using the withhold set.
Forecast Visualizations shows the metric, the forecast and the confidence envelope.
This plot is divided into three parts, training, withholding and forecasted.
The training part of the visualization shows the tight envelope around the actual values
of ‘distinct_addresses’; the predicted values are similar to the actual values.
Next is the withheld data, where we are testing our forecasting algorithm, we know both the
forecasted values and the actual values.
This portion of the data is also used to compute validation statistics like R^2 and RMSE.
Finally, we have the Forecast, where we don’t have the actual value to compare against.
The uncertainty as we forecast further into the future is reflected in the larger confidence
envelope.
The Forecast Outliers panel shows the no. of outliers detected in the forecasted data,
meaning values that fell outside the confidence bounds.
These outliers could also be plotted over time using the ‘Plot Outliers Over Time’
button.
On the “Load Existing Settings” tab we can compare different setups used for detecting
outliers using statistics such as R-Square and Root Mean Squared Error, etc. and reload
the one that worked best.
These results are then forwarded to an event planner who can further use these details
to arrange the security, transportation, catering and other aspects of any event.
We can also apply our configuration to new data.
These assistants not only walk you through the steps required to forecast a field, but
all of these tools can be reused and provide a variety of options for operationalizing.
You can view the SPL commands used at every step, create alerts based on the output generated
or use one of the validation panels on your own dashboard.
To learn more about the Machine Learning Toolkit, including the other Assistants, browse through
our ML videos.