topic Re: Prediction on disk transfer / sec in Splunk Search

Prediction on disk transfer / sec

singh3and12 — Wed, 30 Sep 2020 00:37:53 GMT

Hi ,

I have used following query for predicting disk transfer of particular host, here we are using LLP algorithm in predict command so, under visualization tab the two confidence interval along with the predicted value is reflecting, for future 10 days. i just wanted to show only the predicted value on the dashboard. while we hover over. i did use the supress command but somehow it dint work. Any help would be appreciated.

below is query,

index="acn_infrastructure_tier3_idx" metric_label="PhysicalDisk : Disk Transfers/sec Alert" source_host=AUSYDSPLUNK6 earliest=-15d |timechart span=5min avg(metric_value)
as "Disk Transfer/sec" |predict "Disk Transfer/sec" AS "Predicted value"
algorithm=LLP future_timespan=2880 |sort _time desc

Re: Prediction on disk transfer / sec

koshyk — Mon, 20 May 2019 08:28:09 GMT

Please try

index="acn_infrastructure_tier3_idx" metric_label="PhysicalDisk : Disk Transfers/sec Alert" source_host=AUSYDSPLUNK6 earliest=-15d 
|timechart span=5min avg(metric_value)  as disk_transfer_sec
|predict disk_transfer_sec AS predicted_value  algorithm=LLP future_timespan=2880 
| where _time > now()

Re: Prediction on disk transfer / sec

singh3and12 — Mon, 20 May 2019 09:06:35 GMT

it dint work out... still the same... i did try to change it and run but getting the same result

Re: Prediction on disk transfer / sec

koshyk — Mon, 20 May 2019 09:21:04 GMT

when i use above query, i get ONLy the predicted_value in my dashboard. Is that what you were looking for?

Re: Prediction on disk transfer / sec

singh3and12 — Mon, 20 May 2019 09:27:12 GMT

yes i was looking for predicted value and the present value(the current real time along) in the dashboard. but when i run it after using where clause.. and hover over it does reflect the lower n upper values .. also

Re: Prediction on disk transfer / sec

singh3and12 — Mon, 20 May 2019 09:27:57 GMT

is there any other way to achieve it .. would be helpful.

Re: Prediction on disk transfer / sec

koshyk — Mon, 20 May 2019 09:44:21 GMT

ah.sorry. I misunderstood. I thought you just need the predicted value ONLY.

Normally, the current value is shown with different colour and predicted_value with another colour. I'm not sure a way to set focus on mouse drag. May be experts in UI would help on that.

Re: Prediction on disk transfer / sec

singh3and12 — Mon, 20 May 2019 10:13:34 GMT

for me.. all are coming in smae color only it gets differentiated when i hover over the graph

Re: Prediction on disk transfer / sec

koshyk — Mon, 20 May 2019 10:14:54 GMT

which version of Splunk you using? Mine comes with blue colour (default) for old values and yellow for predicted values

Re: Prediction on disk transfer / sec

DavidHourani — Mon, 20 May 2019 11:38:19 GMT

Hi @singh3and12,

If you want to get rid of the upper and lower intervals in your predict you simply have to get rid of the lower and upper fields like this :

index="acn_infrastructure_tier3_idx" metric_label="PhysicalDisk : Disk Transfers/sec Alert" source_host=AUSYDSPLUNK6 earliest=-15d |timechart span=5min avg(metric_value) 
as "DTs" |predict "DTs" AS "DTsPredicted" 
algorithm=LLP future_timespan=2880 |sort _time desc
| fields - lower95(DTsPredicted) upper95(DTsPredicted)

Let me know how that works out for you!

Cheers,
David

Re: Prediction on disk transfer / sec

singh3and12 — Wed, 22 May 2019 05:53:04 GMT

Hi David,

Thanks, it worked for me.... I am able to remove the upper n lower fields from the graph.

Re: Prediction on disk transfer / sec

singh3and12 — Wed, 22 May 2019 05:54:04 GMT

we are using 7.1 version.

Re: Prediction on disk transfer / sec

DavidHourani — Wed, 22 May 2019 05:56:01 GMT

most welcome @singh3and12 !