https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452488#M78403 <P>@adam_dixon95 - The math is easy , the historical data is very difficult,<BR /> Youcan use MLTK or the inbuilt time series forecasting using the predict command<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Predict">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Predict</A><BR /> BUT<BR /> you need a big chunk of historical data, based on the time range you are looking to predict for.<BR /> For example if you are looking at every hour , you would probably need an hourly historical data set for the last 1 year at a bare minimum to make a good prediction.<BR /> If you are looking at every 5 minutes, maybe you need a 5 minutes based data set for the last 3 months.<BR /> Thumb rule - more data is not necessarily better, but coverage is. If your data is cyclical (typically all businesses have some cycles - eg more sales in new year/Christmas) and you do not include the historical data for that while making a prediction, chances are that your model will fail for 2019 Christmas</P> Fri, 16 Aug 2019 15:53:32 GMT Sukisen1981 2019-08-16T15:53:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452487#M78402 <P>Hi,</P> <P>I'm currently ingesting Sysmon logs from 100 hosts, event are currently stable. Though I'm looking to be sending 10x more Sysmon hosts to Splunk. </P> <P>These are quite busy log sources and so I'd like to find a way, within Splunk to estimate the license usage per the Sysmon SourceType and potentially provide a graph to show predicted growth/usage in license usage AND/OR event count.</P> <P>Thanks </P> Fri, 16 Aug 2019 15:40:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452487#M78402 adam_dixon95 2019-08-16T15:40:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452488#M78403 <P>@adam_dixon95 - The math is easy , the historical data is very difficult,<BR /> Youcan use MLTK or the inbuilt time series forecasting using the predict command<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Predict">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Predict</A><BR /> BUT<BR /> you need a big chunk of historical data, based on the time range you are looking to predict for.<BR /> For example if you are looking at every hour , you would probably need an hourly historical data set for the last 1 year at a bare minimum to make a good prediction.<BR /> If you are looking at every 5 minutes, maybe you need a 5 minutes based data set for the last 3 months.<BR /> Thumb rule - more data is not necessarily better, but coverage is. If your data is cyclical (typically all businesses have some cycles - eg more sales in new year/Christmas) and you do not include the historical data for that while making a prediction, chances are that your model will fail for 2019 Christmas</P> Fri, 16 Aug 2019 15:53:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452488#M78403 Sukisen1981 2019-08-16T15:53:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452489#M78404 <PRE><CODE> index=_internal source="*license_usage.log*" type=Usage | eval yearmonthday=strftime(_time, "%Y%m%d") | stats sum(eval(b/1024/1024)) AS volume_mb by idx st yearmonthday </CODE></PRE> Mon, 19 Aug 2019 02:03:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452489#M78404 nareshinsvu 2019-08-19T02:03:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452490#M78405 <P>hi @adam_dixon95 <BR /> Were you able to make some progress on this question?</P> Mon, 19 Aug 2019 14:58:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-predict-event-increase-license-usage-by-sourcetype/m-p/452490#M78405 Sukisen1981 2019-08-19T14:58:25Z