https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132080#M36027 <P>I think you have a typo in your failing line. It looks like you mean:</P> <P>... | timechart avg(Total) span=1h <STRONG>AS Total</STRONG> | ...</P> Thu, 09 Apr 2015 14:26:30 GMT aweitzman 2015-04-09T14:26:30Z https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132079#M36026 <P>Hi,</P> <P>Looking to start using Splunk to do trending and forecasting (predict).</P> <PRE><CODE>index=os sourcetype=cpu host=ukdc1-xxx-xxx* earliest=-1w | eval Total=(pctSystem+pctUser) | timechart avg(Total) span=1h | predict Total future_timespan=168 algorithm=LL </CODE></PRE> <P>Getting the old 'Too few data points' error.</P> <P>This works, but i need the two cpu fields added together to get the total amount of CPU busy time...</P> <PRE><CODE>index=os sourcetype=cpu host=ukdc1-xxx-xxx* earliest=-1w | timechart avg(pctSystem) span=1h AS AVG | predict AVG future_timespan=168 algorithm=LL </CODE></PRE> Thu, 09 Apr 2015 14:22:56 GMT https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132079#M36026 rob3770 2015-04-09T14:22:56Z https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132080#M36027 <P>I think you have a typo in your failing line. It looks like you mean:</P> <P>... | timechart avg(Total) span=1h <STRONG>AS Total</STRONG> | ...</P> Thu, 09 Apr 2015 14:26:30 GMT https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132080#M36027 aweitzman 2015-04-09T14:26:30Z https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132081#M36028 <P>That did it!</P> <P>The lower95 line is dropping to -25, can this be contained as -25% CPU utilization isn't really possible?</P> <P>Cheers</P> Thu, 09 Apr 2015 15:27:31 GMT https://community.splunk.com/t5/Splunk-Search/Predict-stops-working-when-eval-used/m-p/132081#M36028 rob3770 2015-04-09T15:27:31Z