Splunk Operational Intelligence Cookbook - Third Edition

Create and apply a machine learning model of traffic over time

The Splunk Machine Learning Toolkit introduces the ability to create and train a machine learning model, which in this example will store the results of running a machine learning algorithm on a dataset of traffic counts over time to be applied later against the same dataset. First, create and train the machine learning model:

index=main sourcetype=access_combined | timechart span=1h count | fit LinearRegression fit_intercept=true "count" from "_time" into "ml_traffic_over_time"

Here, we calculate the number of events in 1-hour intervals. Then, we use the fit command to create the model named ml_traffic_over_time, using the LinearRegression algorithm, to predict the count over ...