predict future_timespan value as a calculated variable

danan5 — Wed, 30 Sep 2020 03:42:43 GMT

Hi,
I am trying to use the predict function to predict hourly values through to the end of the current day. To do this I need to pass to the future_timespan option a decreasing number as the day progresses. ie at midday future_timespan = 12, at 3pm future_timespan=9 etc.

I have some fairly ugly eval statements that give me a value of the number of hours remaining in the current day, however, I don't see how I can pass a value back to the command as a variable.

Any hints greatly appreciated.
David

Re: predict future_timespan value as a calculated variable

danan5 — Wed, 30 Sep 2020 03:51:00 GMT

So finally worked out how to do it, was a knowledge gap on my part. I didn't understand the "." option in the eval command to concatenate a string with a calculated value, and the sub search returning it all as an option/variable to the predict command.

Below is an example, generating prediction of data ingest through to the end of the current day.

index=_internal source=license_usage.log type=Usage earliest=@d | eval gb=b/1024/1024/1024
| reverse
| accum gb as totalb
| timechart last(totalb) span=1m as tc_totalb
| predict tc_totalb algorithm=LLT holdback=1 [| gentimes start=-1 | eval search="future_timespan=".round((relative_time(now(),"+1d@d")-now())/60) | table search] AS predicted_usage
| eval upper95(predicted_usage)=if(_time<=now(), predicted_usage, 'upper95(predicted_usage)' )
| eval lower95(predicted_usage)=if(_time<=now(), predicted_usage, 'lower95(predicted_usage)' )
| rename tc_totalb as "Data Ingested"

topic predict future_timespan value as a calculated variable in Splunk Search

predict future_timespan value as a calculated variable

Re: predict future_timespan value as a calculated variable