topic Re: timechart avg(bytes) by... not working with predict in Splunk Search

timechart avg(bytes) by... not working with predict

erickyi — Tue, 29 Sep 2020 16:28:44 GMT

I tried various combinations but failed

index="flowintegrator" src_port=21
|eval thisUser=src_ip + "="+ dest_ip
| timechart avg(bytes) as volume by
thisUser|predict thisUser
index="flowintegrator" src_port=21
|eval thisUser=src_ip + "="+ dest_ip
| timechart avg(bytes) as avg_bytes
by thisUser|predict avg_bytes

This works but I can't predict.
index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser

Help

Re: timechart avg(bytes) by... not working with predict

erickyi — Thu, 26 Oct 2017 00:38:10 GMT

forgot to mention about the error in predict
e.g.
Command: predict, unknown field: avg_bytes

Re: timechart avg(bytes) by... not working with predict

HiroshiSatoh — Tue, 29 Sep 2020 16:28:46 GMT

See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".

ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ･･･

Re: timechart avg(bytes) by... not working with predict

erickyi — Thu, 26 Oct 2017 04:38:57 GMT

thank you HIroshi-san,
|predict 127.0.0.1_127.0.0.2 works
However, the thisUser is dynamic, how can I pass this range of thisUser to predict? If this is not possible, I will mark your answer as correct.

Re: timechart avg(bytes) by... not working with predict

HiroshiSatoh — Thu, 26 Oct 2017 04:52:54 GMT

If you look at the predict manual you can not use wildcards in the field list.
So I think that dynamic designation can not be done.

ex.

predict <field-list>
table <wc-field-list>

Re: timechart avg(bytes) by... not working with predict

erickyi — Thu, 26 Oct 2017 04:58:47 GMT

sounds good to me. I will find another way to do my alert. arigato gozaimasu

Re: timechart avg(bytes) by... not working with predict

erickyi — Tue, 29 Sep 2020 16:28:51 GMT

just thought of something, given my date span is per 7 days, i can rename the ipUser.
|rename "127*" as ip* |predict ip1, ip2, ip3, ip4, ip5, ip6, ip7

Thanks for the inspiration. (y)