topic Need help on predict command in Splunk Search

Need help on predict command

strive — Mon, 28 Sep 2020 14:57:49 GMT

Hi,

I have a requirement to do predictive analysis of a metric. I am referring the link http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Predict to understand predict command. In this link, there is no default specified for many options. Only lower and upper predict options have default values.

Is the documentation incomplete?

I have a timechart with three values plotted.

| timechart partial=false span=5m first(Average) as Average first(Peak) as Peak first(Capacity) as Capacity

I added predict command in the end..

| timechart partial=false span=5m first(Average) as Average first(Peak) as Peak first(Capacity) as Capacity | predict Average

I have 288 results from the search. The predict command values are plotted only till 143 results. After that everything is blank. If i use future_timespan option then i am able to get predict values for other results based on value set for future_timespan.

Why splunk is stopping predicting at 143 results? It is very difficult to set the value for future_timespan unless i know the behavior of predict command.

What is the default value of future_timespan?

Am i missing something here? Please help me.

Thanks

Strive

Re: Need help on predict command

nnguyen_splunk — Wed, 16 Oct 2013 21:49:50 GMT

Hi,
First, the default value for future_timespan is 5.
Second, I don't know why splunk stopped predicting at 143 results. Does it plot 288 results if you don't pipe it through predict?

Re: Need help on predict command

HattrickNZ — Thu, 05 Mar 2015 22:00:08 GMT

from the docs it says that future_timespan is a number. but my question is what is the period is it 5 hours,days,weeks...etc? where can we controld this or is it controlled by the span=d you use in your timechart

Re: Need help on predict command

pred312 — Tue, 29 Sep 2020 20:53:50 GMT

Yes, the span is controlled by the span mentioned in your timechart command. If you write |timechart span=1d then when using your future_timespan="182" . It means that the future time span is 182 days. If you chose your timechart span to be 1 hour, the future_timespan would showcase 182 hours. etc