All Apps and Add-ons

Unable to see the host and drive in search results when using prediction

Loves-to-Learn Lots

Hello Guys,

I am trying to create a search where I want to retrieve following week's diskusage values using a 95 percentile confidence interval and extract the earliest moment the partition could run out of space.

So far I have come up with this search but I am not able get the value of full_result in my search. 



| mstats avg(LogicalDisk.Free_Megabytes) as DiskFree WHERE index=blah-cloud-metrics AND host!=DEV-* (instance=C: OR instance=D: OR instance=G: OR instance=H:) span=10m by host,instance
| eval full_result = host+"****"+instance
| timechart span=10m avg(DiskFree) as DiskFree
| predict future_timespan=1008 DiskFree|search "lower95(prediction(DiskFree))" <= 0
|head 1| table _time,lower95(prediction(DiskFree)),full_result



 Essentially I need the host, drive (instance), lower95(diskfree) and _time values in the output of my search. Feel free to post your suggestions if you have better search options in mind. Thank You!



Labels (3)
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...