All Apps and Add-ons

Splunk Predict App: Why is the app excluding step changes in data?

rob3770
Explorer

Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out.

index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E:
| timechart span=24h max(Value) usenull=f  | predict max(Value)  future_timespan=90

Also can it be run against multiple host or disks?

Cheers

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Not quite sure what you mean by "freaks out" (picture might help?)

I'll have a stab at this though:

Predict uses LLP5, which includes "seasonality" (recurring patterns),

try feeding it more historical data and/or tune the period, this should average things out,
you might want to change to "LLT" instead of you don't want seasonality at all?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Predict#Predict_options

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...