Splunk Predict App: Why is the app excluding step changes in data?

[rob3770]

Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out.

index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E:
| timechart span=24h max(Value) usenull=f  | predict max(Value)  future_timespan=90

Also can it be run against multiple host or disks?

Cheers

[mhoogcarspel_sp]

Not quite sure what you mean by "freaks out" (picture might help?)

I'll have a stab at this though:

Predict uses LLP5, which includes "seasonality" (recurring patterns),

try feeding it more historical data and/or tune the period, this should average things out,
you might want to change to "LLT" instead of you don't want seasonality at all?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Predict#Predict_options