Cisco Splunk has introduced the Cisco Time Series ModelA univariate, zero shot foundation time series designed for security and observability metrics. This open-weight checkpoint is available under Apache 2.0 and targets workload forecasting, without any task-specific fine tuning. It extends TimesFM 2.0 by a multiresolution architectural extension that integrates fine and coarse history into one context window.
Multiresolution context is needed for observability?
The production metrics is not a simple signal at a single scale. Only coarse resolutions can reveal weekly patterns, growth over time and saturation. At 1 or 5 minute time resolution, saturation events, traffic spikes, and incident dynamics are visible. Common time series models have a resolution of 512 to 4096 context points. TimesFM 2.5 increases this up to 16384 point. This is still only a few weeks or less for 1 minute data.
It is an issue of observability, as data platforms tend to retain old data only in aggregated format. Rollups of 1 hour are the only way to preserve fine-grained data samples. Cisco Time Series Model was built to accommodate this pattern of storage. It uses coarse history to improve forecasts when using fine resolution. Instead of pretending to all inputs being on a single scale, the architecture works directly in a context with multiple resolutions.
Input and Forecasting Multi-Resolution
The model is a formal consumption of two contexts (xCThe, xF). Each coarse context (x_c), and fine context (x_f), have a length of up to 512. The spacing between (x)CThe spacing between (x) and ) must be 60 times larger than the distance between (x).F). In a typical setup, 512 hours are aggregated into 1 hour values and 512 minute of 1 min. The forecast is the same for both series. Models predict a fine resolution horizon with 128 points, a mean value and quantiles of 0.1-0.9.
TimesFM Core with embedded resolution
Cisco Time Series Model internally reuses TimesFM’s patch-based decoder. The inputs have been normalized, patched in non-overlapping chunks and are then sent through a residual embedded block. The core of the transformer consists only 50 decoder layers. Tokens are mapped back into the horizon by a final residual block. Researchers remove the positional embeddings, and instead use patch ordering and multiresolution structures as well as a new embedding for resolution to encode structure.
A multi-resolution architecture can be made by adding two new features. The report inserts a token called ST between the coarse token stream and the fine token stream. The token is located in the sequence space, and it marks the boundaries between resolutions. In model space, resolution embeddings (also called RE) are created. A single embedding vector for coarse and fine tokens is used. The paper shows that the ablation tests show both components to improve quality. This is especially true in situations with large contexts.
Decoding is multi-resolution. Model outputs quantile and mean forecasts of the fine resolution. The fine context is updated with the newly predicted points during long-horizon decoding. The aggregates of these forecasts update the coarse context. The forecasting process is a continuous auto-regressive cycle.
Train the Trainer and Recipe
Cisco Time Series Model can be trained using continued pre-training on TimesFM weights. Model final has 500,000,000 parameters. AdamW is used for hidden layers and Muon to train the model. Rate schedules for cosine are also applied. Loss is calculated by combining mean squared errors on forecast mean with quantile losses over quantiles ranging from 0.1-0.9. The team selects a checkpoint based on validation loss after training for 20 epochs.
The dataset is big and heavily skewed in favor of observability. Splunk’s team has reported 400,000,000 metrics time series collected by their Splunk deployments at 1 minutes resolution for 13 months, and partially aggregated into 5 minute data. The team of researchers states that this final corpus has more than 300 million unique data points. This includes 35 percent 1 minutes observability data, 16.5% 5 minutes observability data, 29.5 % GIFT Pretraining Data, 4.5 % Chronos datasets as well as 14.5 % synthetic KernelSynth Series.
Benchmarking results for GIFT and observability
The team of researchers evaluates the model against two benchmarks. First, an observability data set derived from Splunk metrics with 1 minute or 5 minute resolution. The second version is a filtered GIFT Eval in which datasets that contain TimesFM training data have been removed.
Cisco Time Series Model using the 512 Multiresolution Context reduces average absolute error by 0.6265 in TimesFM 2.5, 0.6315 in TimesFM 2.0, to 0.4788. This improvement is also seen for scaled absolute error and the continuous probability score. The gains at five minute resolution are similar. The model is superior to Chronos 2 and Chronos Bolt baselines in both resolutions.
Cisco Time Series Model performs similarly to the TimesFM 2.0 base model on the filtered GIFT benchmark and is competitive with Chronos-2, Toto, and TimesFM 2.5. It is important to note that the key point here is not dominance, but rather preserving general forecasting while adding an advantage in long context windows.
What you need to know
- Cisco Time Series Model (CTM) is an univariate, zero-shot time series model. It extends TimesFM 2.0’s decoder backbone to include a multiresolution architectural design for security and observability metrics.
- This model uses a context with multiple resolutions, with coarse and fine steps of up to 512, the coarse being 60 times as fine. It predicts the outputs for 128 steps at fine resolution with the mean and quantile.
- Cisco Time Series Model was trained using more than 300B points of data. More than half came from observability. The model is a mix between Splunk machine datasets (GIFT Eval), Chronos data and synthesized KernelSynth data.
- In observingability benchmarks with 1 minute and 5-minute resolutions the model has lower error rates than TimesFM, Chronos or other baselines. It also maintains competitive performance in the general-purpose benchmark GIFT Eval.
Click here to find out more Paper, Blog The following are some examples of how to get started: Model Card on HF. Check out our GitHub Page for Tutorials, Codes and Notebooks. Also, feel free to follow us on Twitter Don’t forget about our 100k+ ML SubReddit Subscribe now our Newsletter. Wait! What? now you can join us on telegram as well.
Asif Razzaq, CEO of Marktechpost Media Inc. is a visionary engineer and entrepreneur who is dedicated to harnessing Artificial Intelligence’s potential for the social good. Marktechpost is his latest venture, a media platform that focuses on Artificial Intelligence. It is known for providing in-depth news coverage about machine learning, deep learning, and other topics. The content is technically accurate and easy to understand by an audience of all backgrounds. This platform has over 2,000,000 monthly views which shows its popularity.
