Have you ever tried to forecast server load? It’s a classic headache. You’re looking at your monitoring dashboard, trying to figure out what’s coming next. You can see the big, slow-moving patterns—like how traffic always dips on the weekend and climbs on Monday morning. That’s the big picture.
But then, out of nowhere, you get a massive spike. A product launch, a viral tweet, a DDoS attack. That’s the nitty-gritty, minute-by-minute detail.
The problem is, most forecasting models are good at one or the other. They can see the long-term trends or they can see the short-term chaos, but they struggle to see both at the same time. It's like trying to navigate a city with either a satellite map or a street-level photo, but never both.
Well, it looks like Cisco and Splunk have been thinking about this exact problem. They just dropped their first open-weights foundation model, the Cisco Time Series Model, and it’s designed from the ground up to handle this exact kind of messy, real-world data. And honestly, the way they've approached it is pretty clever.
Why Most AI Models Get a Blurry Picture of Time
So, what's the big deal here? Let's get into it.
Most time series models, even the really powerful ones, look at data at a single resolution. They might take in a window of, say, 512 data points. If your data is recorded every minute, that gives them a view of the last 8.5 hours. That's great for catching sudden spikes, but it completely misses the weekly or monthly patterns.
You could feed it data aggregated by the hour, but then you lose all the fine-grained detail. You can’t see the five-minute outage if you’re only looking at hourly averages. This is a huge issue in observability, where data platforms often save money by rolling up old data. They might keep minute-by-minute data for a few weeks, but anything older gets squished into hourly aggregates.
This is where the new Cisco model really changes the game. It doesn't force you to choose. It’s built to look at both the coarse, long-term history and the fine, recent history all at once.
Looking Through Two Lenses at Once
Think of it like this: the model takes in two streams of data at the same time.
- The Coarse Context (
x_c): This is your big-picture view. For example, it might be 512 hours of data, with one data point per hour. This shows the model the weekly cycles and long-term growth. - The Fine Context (
x_f): This is your close-up view. It might be 512 minutes of data, with one point per minute, leading right up to the present moment. This shows the model the immediate, high-frequency changes.
The model is designed to see that the coarse data is exactly 60 times less detailed than the fine data (e.g., hours vs. minutes). It consumes both of these streams together to make a much more informed prediction about what’s going to happen next—specifically, forecasting the next 128 minutes at that fine resolution.
It’s a simple idea on the surface, but making it work under the hood required some smart architectural tweaks.
How They Pulled It Off: A Peek Inside the Model
For those of us who like to get a bit nerdy, let's pop the hood. The Cisco Time Series Model is built on the same foundation as Google's TimesFM, which is a powerful decoder-only transformer. But the Cisco and Splunk teams added a couple of key ingredients to make it "multiresolution-aware."
First, they insert a special "boundary" token right between the stream of coarse data and the stream of fine data. You can think of this as a little flag that tells the model, "Okay, everything you saw before this was the big-picture view. Everything after this is the close-up view." It’s a simple but effective way to help the model distinguish between the two contexts.
Second, they added something called "resolution embeddings." This is even cooler. They add a little bit of extra information to each data point that essentially labels it as either "coarse" or "fine." It’s like giving the model two different sets of glasses—one for looking at the long-term data and one for the short-term. The team’s research paper showed that both of these additions were crucial for getting the best performance.
And it doesn't stop there. When the model starts making predictions, it does so in a multiresolution loop. It predicts the next few minutes, then it aggregates those predictions to update its understanding of the next hour, and uses that updated understanding to make the next prediction. It’s a constant feedback loop that keeps both resolutions in sync.
Trained on the Real World (A LOT of It)
A model is only as good as the data it’s trained on, and this is where things get really impressive. The team didn't just use standard, clean datasets. They threw the kitchen sink at this thing.
The model, which has about 500 million parameters, was trained on over 300 billion unique data points. That’s a staggering amount of data.
And here’s the important part: a huge chunk of that data (over half!) came from Splunk's own Observability Cloud deployments. We're talking about 400 million real-world metric time series, collected over 13 months. This is the messy, unpredictable data that DevOps and SRE teams deal with every single day. They also mixed in data from other well-known benchmarks and even some synthetic data to round things out.
This means the model wasn't just trained in a sterile lab environment. It was forged in the fires of actual production systems.
So, How Well Does It Actually Work?
Alright, let's get to the bottom line. Does all this fancy architecture and massive training data actually pay off?
The short answer is: yes, absolutely.
When the research team tested it on observability datasets from Splunk, the results were pretty dramatic. Compared to the very capable TimesFM models, the new Cisco model cut the mean absolute error by a significant margin—we’re talking a reduction from around 0.62 to 0.47 in one benchmark. That’s a huge leap in accuracy for this kind of work. It consistently outperformed other popular models like Chronos and AutoARIMA as well.
Now, what’s really interesting is its performance on general-purpose forecasting tasks. On those, it performed competitively, right alongside the other top models. This is key. The team's goal wasn't to create a model that beats everything on every possible task. Their goal was to build something that is exceptionally good at long-context, multiresolution observability tasks, while still being a strong generalist.
And it seems they nailed it. You get a specialist's performance on the hard stuff without sacrificing general forecasting ability.
What This Means for Us
For anyone working in observability, security, or any field that relies on time series data, this is genuinely exciting news. We finally have an open-source tool (it’s on Hugging Face with an Apache 2.0 license) that understands the fundamental nature of our data—that it exists on multiple timescales at once.
It’s a move away from a one-size-fits-all approach and toward models that are purpose-built for the specific, tricky problems we face. It’s a great example of taking a powerful existing architecture and adapting it with a deep understanding of the problem domain. I, for one, can't wait to see what people start building with it.
