topic Re: Run predict command for multiple disk in same query in Splunk Search

Run predict command for multiple disk in same query

RSS_STT — Mon, 05 May 2025 07:40:56 GMT

I have multiple disk like C, D & E on server and want to do the prediction for multiple disk in same query.

index=main host="localhost" instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180

Could anyone help with modified query.

Re: Run predict command for multiple disk in same query

ITWhisperer — Mon, 05 May 2025 08:16:21 GMT

Assuming instance contains the disk you want to predict, you could try something like this

Re: Run predict command for multiple disk in same query

livehybrid — Mon, 05 May 2025 09:25:29 GMT

Hi @RSS_STT

The predict command can take a number of fields, such as in this example below, allowing you to run the predict against all your drives.

| makeresults count=5 | streamstats count | eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:") | eval Value = case(instance=="C:", 90 - count*5, instance=="D:", 80 - count*4, instance=="E:", 70 - count*3) | append [| makeresults count=5 | eval _time = relative_time(now(), "-1h") | streamstats count | eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:") | eval Value = case(instance=="C:", 880 - count*5, instance=="D:", 82 - count*4, instance=="E:", 70 - count*3)] | fields _time, instance, Value | timechart min(Value) as "FreeSpace" by instance | fillnull "C:" "D:" "E:" | predict "C:" "D:" "E:" algorithm=LLP5 future_timespan=180

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing