Feedback:

fit ARIMA

Use the ARIMA algorithm when you want to fit a model using the statsmodels ARIMA (Auto-Regressive Integrated Moving Average) method for forecasting time series data.

This operator also supports seasonal ARIMA to provide reliable forecasting patterns for data with seasonal intervals such as daily, weekly, or monthly intervals through the seasonal_order parameter explained in the Usage section. The model, therefore, captures recurring patterns such as:

  • Daily cycles (for example, login peaks during business hours)

  • Weekly cycles (for example, weekday versus weekend network traffic)

  • Other periodic behaviors (for example, batch jobs or month‑end activity)

When you apply the model, all original observations are retained and the results include actual values and predictions in separate columns, helping you more readily identify where the model forecast deviates from reality.

See the official statsmodels ARIMA documentation for more information.

Syntax

fit ARIMA [arima_order='<p>-<d>-<q>'] [seasonal_order='<P>-<D>-<Q>-<s>'] [forecast_k=<forecast_steps>] [conf_interval=<confidence>] [holdback=<exclude_from_training>] <value_field> from <time_field>

<p>-<d>-<q>

(Optional) Non-seasonal ARIMA parameters that determines the complexity of the model, where:

  • p – Autoregressive (AR) order

  • d – Differencing order

  • q – Moving average (MA) order

Default='1-1-1'
<P>-<D>-<Q>-<s>

(Optional) Seasonal ARIMA parameters P-D-Q-s, where:

  • P=seasonal AR order,

  • D=seasonal differencing,

  • Q=seasonal MA order,

  • s=seasonal period for example, 24 for hourly data with daily seasonality, 7 for daily data with weekly seasonality)

Example:

seasonal_order='1-1-1-24' denotes hourly data with daily seasonality.

seasonal_order='0-1-1-168' denotes weekly seasonality on hourly data (24 × 7).
forecast_steps

(Optional) Number of future time steps to forecast, that is, how far into the future the model will predict.

For example, forecast_k=24 on hourly data forecasts the next 24 hours.

Default: 0
confidence

(Optional) Confidence interval width (in percent) around the forecast values.

For example, conf_interval=95 creates 95% upper and lower confidence bounds, signifying that there is a 95% probability that the actual future values will be within the calculated confidence interval around the forecasted values.

Default: 95
exclude_from_training

(Optional) Number of most recent observations to exclude from model training and keep for backtesting. For example, if you have 100 data points and set holdback to 10, the last 10 data points will not be used in training the model.

Default: 0
value_field Required. The numeric field containing the time‑series values to model and forecast, for example, event counts, login counts, or bytes transferred.
time_field Required. The time field that defines the ordering of the series.

Usage

You can use seasonal ARIMA with seasonal_order to:

  • Forecast time‑series metrics that exhibit recurring patterns (daily, weekly, or other cycles).

  • Reduce false positives by distinguishing normal seasonal spikes from genuine anomalies.

Common real-world use cases include:

  • Authentication logs: Business‑hours peaks and overnight troughs.

  • Network traffic: Different traffic levels during weekdays versus weekends, or day versus night.

  • Batch jobs and reports: Periodic spikes from scheduled tasks.

Examples

Example 1: Learns how dest_port has changed over time, and predicts the next 100 time points of dest_port, with a 90% confidence band for each prediction.

Copy 
| fit ARIMA forecast_k=100 conf_interval=90 dest_port from event_time 

Example 2: Models hourly Azure AD login counts over the past seven days, capturing weekly seasonality with a seven‑hour cycle on hourly data.

Copy 
| where sourcetype ='azure_ad'
| where event_time earliest=-7d, latest=-1h timetrend columnname=timestamp count as log_count span=1h
| fit ARIMA forecast_k=24
          arima_order='2-1-2'
          seasonal_order='1-1-1-7'
          conf_interval=95
          holdback=24
          log_count from timestamp

Example 3: Forecasts the next three hourly event count values using SARIMAX, trained on the hourly event trend derived from OCSF data.

Copy 
ocsf | timetrend count as test span=1h | predict test SARIMAX forecast_k=3