All Apps and Add-ons

Splunk Predict App: Why is the app excluding step changes in data?

rob3770
Explorer

Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out.

index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E:
| timechart span=24h max(Value) usenull=f  | predict max(Value)  future_timespan=90

Also can it be run against multiple host or disks?

Cheers

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Not quite sure what you mean by "freaks out" (picture might help?)

I'll have a stab at this though:

Predict uses LLP5, which includes "seasonality" (recurring patterns),

try feeding it more historical data and/or tune the period, this should average things out,
you might want to change to "LLT" instead of you don't want seasonality at all?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Predict#Predict_options

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...