CODEWITHSUNDEEP
time-seriesazure-data-explorerkql
Jeremy Fisher
Jeremy Fisher

Reputation: 2782

kusto series_decompose_forecast() returning all nulls

I am trying to explore the forecasting function provided by kusto. I tried the sample which obviously generated the forecasting trend shown by the docs. However, I then tried the forecasting function with similar parameters on our production data. For some reason the forecasted values are all null.

Our kusto raw data looks like the following:

enter image description here

I would like to forecast the values of a0. Here is my query:

...
| distinct ['name']))
| summarize a0=avg(todouble(['temp'])) by d0=bin(['timestamp'], 1s), d1=['name']
| summarize timeAsList = make_list(d0), dataAsList0 = make_list(a0)
| extend forecast = series_decompose_forecast(dataAsList0, 60*60*24*3) // 3 day forecast
| render timechart

This is what the query renders:

enter image description here

This line is just our production data, not a forecast. The actual forecast array is just an array of nulls, as you can see.

What is wrong with the query?

Upvotes: 0

Views: 706

Answers (1)

Adi E
Adi E

Reputation: 488

The second parameter of series_decompose_forecast defines the number of points to leave out of training from the original time series. In your case the length of your original time series is ~1:39 hours (just by looking at the screenshot) so setting 3 days to leave out leaves no data for training. You need to extend the time series with the forecast period prior to calling series_decompose_forecast. Also I recommend using make-series to create the time series, filling empty gaps, instead of summarize by bin and make list. So the final query should look like below. I cannot test it as I have no access to the data. If you need please share a sample datatable and I can craft you the full working query

thanks Adi

let start_time=datetime(...);
let end_time=datetime(...);
let dt=1s;
let forecast_points=60*60*24*3
tbl
| make-series a0=avg(todouble(temp)) on timestamp from start_time to (end_time+forecast_points*dt) step dt 
| extend forecast = series_decompose_forecast(a0, forecast_points) // 3 day forecast
| render timechart

Upvotes: 1

Related Questions