Splunk® Machine Learning Toolkit

User Guide

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Machine Learning Toolkit. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Predict Numeric Fields

MLApp PredictNumericFields.png

The Predict Numeric Fields assistant performs a prediction on numeric values, using an algorithm commonly called Linear Regression, which fits a line to the data. Such models are useful for determining to what extent certain peripheral factors contribute to a particular metric result. Once the regression model is computed, you can use these peripheral values to make a prediction on the metric result.

Algorithm

  • Linear Regression

Workflow

To predict numeric fields, you must fit and train a model. The basic steps are as follows:

  1. Enter a search to retrieve your data, then click the search button to run it.
  2. Select the numeric field you want to predict. This list of fields is populated by the search you just ran.
  3. Select a combination of fields you want to use for predicting the numeric field. This list contains all of the fields from your search except for the field you selected to predict.
  4. Specify how much of your data to use for training (fitting the data model) versus testing (validating the model afterwards). The data is divided randomly into two groups. The default split is 50/50.
  5. Name the model. This name and the settings you select are saved in the history.
  6. Click Fit Model.

Interpret and validate

After you fit the model, review the Validate Model section to see how well the model predicted the numeric field.

  • Raw Data Preview: Displays the raw data from the search.
  • Actual vs. Predicted Scatter Plot: Shows the predicted value (the yellow line) against the raw actual values (blue dots) for the field you chose to predict. Hover on the blue dots to see actual values.
  • Interpretation: The yellow line showing the "perfect" result generally isn't attainable, but the closer the points are to the line, the better the model.

  • Residuals Histogram: Displays a histogram of the difference between the actual values (the yellow line) and the predicted values (the blue bars). Hover over the blue bars to see the residual error (different between the actual and predicted result) and sample count (the number of results with this error).
  • Interpretation: In a perfect world all the residuals would be zero. In reality, the residuals probably end on a bell curve that is ideally clustered tightly around zero.

  • R2 Statistic: Explains how well the model explains the variability of the result. 100% (a value of 1) means the model fits perfectly.
  • Interpretation: The closer the value is to 1 (100%), the better the result.

  • Root Mean Squared Error: Explains the variability of the result, which is essentially the standard deviation of the residual. The formula takes the difference between actual and predicted values, squares this value, takes an average, and then takes a square root.
  • Interpretation: This value can be arbitrarily large and just gives you an idea of how close or far the model is. These values only make sense within one dataset however, and shouldn't be compared to values outside of it.

  • Fit Model Parameters Summary: Displays the coefficients associated with each variable in the regression model. A relatively high coefficient value shows a high association of that variable with the result. A negative value shows a negative correlation.
  • Actual vs. Predicted Overlay: Shows the actual values against the predicted values, in sequence.
  • Residuals: Shows the residual (difference between predicted and actual) values, in sequence.

Refine the model

After you have validated the model, the way to refine the model is by adjusting which fields you use to predict the numeric field and fit the model again:

  • Remove fields that might generate a distraction.
  • Try adding more fields. In the Load Existing Settings tab, which displays a history of models you have fitted, sort by the R2 statistic to see which combination of fields yielded the best results.

Deploy the model

Once you have validated and refined a model and are satisfied with it, review the options in the Deploy Model section:

  • Clicking any title takes you to a new Search tab, filled out with a search query that uses all data (not just the training set).
  • Fit Model in Search shows you the search query that was used to fit the model. For example, you could use this same query on a different data set.
  • Some options show interesting data, such as coefficients.
Last modified on 05 August, 2016
PREVIOUS
Custom visualizations
  NEXT
Predict Categorical Fields

This documentation applies to the following versions of Splunk® Machine Learning Toolkit: 1.0.0, 1.1.0, 1.2.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters