Introducing the Cisco Time Series Model: Unlock Machine Data Insights with Gen AI

Cisco and Splunk are excited to announce the preview release of the Cisco Time Series Model, an open-weight time series foundation model that can be easily deployed for reliable forecasting across observability and security operations, automations, and agentic workflows. Unlike statistical or traditional ML models, Cisco Time Series Model is an AI foundation model that does not require task-specific training or tuning before use. With pre-training and innovations tailored to machine data observability, it is ready to deliver accurate forecasts for observability metrics wherever you need them. 

Download the model from Hugging Face and visit the GitHub repo for quick-start code and example notebooks. 

The Cisco Time Series Model v1.0-preview has been pretrained on over 300 billion unique data points sourced from Cisco and Splunk’s observability infrastructure. When measured against our internal observability benchmark dataset, its performance matches or exceeds the industry’s leading models. We’re releasing this preview so development partners and customers can begin integrating it into automations and agentic workflows.

Use Cases

The Cisco Time Series Model supports operational forecasting with a 2–10 hour horizon at 1-minute or 5-minute resolutions.

• For SREs: Incorporate forecasts into automation workflows to scale capacity up or down based on predicted demand.
• For DevOps teams: Integrate the model with alerting logic to enable predictive alerts that notify you of potential incidents early.
• For admins and analysts: Monitor dashboards showing upcoming resource exhaustion or predicted SLO violations before they occur.

This added visibility helps you prevent incidents before they arise.

What Is the Cisco Time Series Model?

The Cisco Time Series Model is a generative AI model pretrained on vast amounts of time series data. It recognizes patterns, trends, and seasonal cycles in a time series’ history to make precise forecasts of how that time series may continue into the near future. Cisco Time Series Model has architectural similarities to large language models (LLMs), except instead of learning relationships among tokenized text, it learns patterns in tokenized segments of time series data.

The core value of Cisco Time Series Model over existing forecasting methods is its “zero-shot” ability. It does not need any more training or fine tuning on a specific time series to make a forecast. You simply submit a time series history to the inference API, and it generates a forecast in a fraction of a second.

Trained for Machine Data Forecasting

Cisco and Splunk are unmatched in the scale and diversity of machine data observed and managed. This provides a unique vantage point across:

• Infrastructure and networking metrics.
• Application and real-user metrics.
• Security signals.

For this preview release, we curated approximately 300 billion unique data points from around 400 million time series covering six months of machine data and general time series data from the GiftEval and Chronos datasets.

The Multiresolution Problem: Seeing the Forest and the Trees

Analyzing machine data requires understanding both short-term, detailed trends and long-term seasonal patterns, which operate at different timescales:

• To identify weekly seasonality reliably, a model must see at least three weeks of historical data.
• To capture daily seasonality, it needs at least three days of history.
• All current time series foundation models accept data at a single time resolution.

If you choose highly aggregated data (e.g., 1-hour), you see seasonal trends but lose short-term detail. If you choose fine-grained data (e.g., 1-minute), you capture recent trends but lose long-term seasonality. In production observability, you need both.

Cisco Time Series Model Multiresolution Architecture

We designed the Cisco Time Series Model with a novel multiresolution architecture that analyzes the time series at 2 different time resolutions

• You can submit up to three months of data points at 1- or 5-minute resolution to the inference API.
• The model converts half of those points into lower-resolution aggregates to learn longer-term seasonal trends.
• The recent half remains at higher resolution to capture short-term dynamics needed for operational forecasts and predictive alerting.

Rather than accepting a single time resolution in the context window, the model converts the time series metric history into 2 equal segments at different time resolutions. Half of the context window will remain at the higher resolution, while the other half will be aggregated to a lower resolution. Specifically, this preview of the model accepts 1024 data points in the context window during inferencing.

• The most recent 512 data points of the time series’ history are kept at the higher resolution (e.g., 1-minute or 5-minute granularity) to preserve operational detail and recent dynamics.
• The remaining part of the time series’ history is aggregated to a lower resolution (e.g., 1-hour or 5-hour aggregates) to fill the other 512 data points of the context window to capture seasonal patterns and longer-term trends.

The model synthesizes these views to produce forecasts at the finer resolution with awareness of both immediate context and longer-term structure.

Model Architecture

The Cisco Time Series Model extends the TimesFM architecture with a novel multiresolution pattern. Key components include:

• Resolution embeddings: Learned embeddings distinguish between coarse and fine resolution inputs.
• Separator token: A special token delineates the transition between resolution contexts, improving parsing of the two input streams.
• Decoder-only transformer: Following TimesFM, we use normalization, patching, padding, and residual blocks for token embedding and un-embedding, with transformer decoder layers for generation.
• Quantile and point predictions: The loss combines mean squared error for point forecasts with quantile loss (q = 0.1, 0.2, ..., 0.9) that represents the confidence bands of the forecast.

Model Performance

At the end of the day, it all comes down to how well the model performs. To answer this, we compare our model and other models against benchmark data sets.  The GIFT-eval benchmark is the most common for general time series that are mostly outside of the domain of machine data. We have developed a benchmark dataset that best represents the challenges presented by machine data.  We will be releasing this machine data benchmark data set with the 1.0 release of the model. 

Here are the evaluation results against the Cisco Machine Data Benchmark for Observability (left) and the GIFT-Eval benchmark (right). The metrics are MAE (blue) and MASE (orange)

What’s Next

This preview release is just the beginning. Expect v1.0 in early 2026 with:

• Expanded resolution support: Additional resolution combinations and finer-grained control.
• Larger training datasets: Continued curation and synthesis to improve performance across edge cases.
• Observability benchmark suite: A comprehensive evaluation dataset reflecting real operational scenarios.
• Enhanced tooling: Improved inference APIs, integration examples, and integration guides.

Download the Cisco Time Series Model v1.0 Preview

• Hugging Face
• GitHub
• Technical Report