Cisco Unveils Time Series Model for Enhanced Forecasting

Cisco Time Series Model Overview

Cisco and Splunk have introduced the Cisco Time Series Model, a univariate zero-shot time series foundation model designed for observability and security metrics. Released as an open weight checkpoint on Hugging Face under the Apache 2.0 license, it specifically targets forecasting workloads without requiring task-specific fine-tuning. The model extends TimesFM 2.0 with an explicit multiresolution architecture that fuses coarse and fine history into a single context window.

Why Observability Needs Multiresolution Context

Production metrics are inherently complex signals. Weekly patterns and long-term growth trends are visible only at coarse resolutions, while saturation events and traffic spikes manifest at 1 or 5-minute intervals. Common time series foundation models generally operate at a single resolution, with context windows ranging between 512 and 4096 points. The Time Series Model, however, extends this capability to 16,384 points, addressing the limitations often seen in observability where data is frequently retained in aggregated forms.

Multiresolution Input and Forecasting Objective

The model works with a pair of contexts, (x_c, x_f), where both the coarse context (x_c) and the fine context (x_f) can reach lengths of up to 512. The interim of (x_c) is fixed at 60 times that of (x_f). The model forecasts 128 fine resolution steps, producing both mean and quantile outputs.

Architecture: TimesFM Core with Resolution Embeddings

Cisco Time Series Model employs a patch-based decoder stack based on TimesFM. It normalizes inputs, patches them into non-overlapping chunks, and processes them through a residual embedding block. With 50 decoder-only layers, the architecture substitutes positional embeddings with a new multiresolution structure, enhancing modeling efficiency.

Training Data and Recipe

This model boasts 500 million parameters and is trained using AdamW for biases, norms, and embeddings, alongside Muon for hidden layers. The training dataset includes approximately 400 million metrics time series sourced from Splunk's Observability Cloud, ultimately amounting to over 300 billion unique data points.

Benchmark Results on Observability and GIFT Eval

Benchmarking against observability datasets at 1 and 5-minute resolutions reveals that the Cisco Time Series Model lowers mean absolute error when compared to TimesFM 2.0. On the GIFT Eval benchmark, it competes favorably with other models while maintaining solid forecasting quality.

Key Takeaways

1. Cisco Time Series Model is designed for zero-shot time series forecasting, enhancing observability and security metrics.
2. It utilizes a multiresolution context, achieving predictive accuracy through its unique architecture.
3. The model trained on a diverse dataset exceeding 300B data points, features around 500M parameters.
4. On multiple benchmarks, it consistently outperformed previous models, showcasing its strength in observability tasks.