All Apps and Add-ons

Splunk Predict App: Why is the app excluding step changes in data?

rob3770
Explorer

Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out.

index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E:
| timechart span=24h max(Value) usenull=f  | predict max(Value)  future_timespan=90

Also can it be run against multiple host or disks?

Cheers

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Not quite sure what you mean by "freaks out" (picture might help?)

I'll have a stab at this though:

Predict uses LLP5, which includes "seasonality" (recurring patterns),

try feeding it more historical data and/or tune the period, this should average things out,
you might want to change to "LLT" instead of you don't want seasonality at all?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Predict#Predict_options

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...