Hello Guys,
I am trying to create a search where I want to retrieve following week's diskusage values using a 95 percentile confidence interval and extract the earliest moment the partition could run out of space.
So far I have come up with this search but I am not able get the value of full_result in my search.
| mstats avg(LogicalDisk.Free_Megabytes) as DiskFree WHERE index=blah-cloud-metrics AND host!=DEV-* (instance=C: OR instance=D: OR instance=G: OR instance=H:) span=10m by host,instance
| eval full_result = host+"****"+instance
| timechart span=10m avg(DiskFree) as DiskFree
| predict future_timespan=1008 DiskFree|search "lower95(prediction(DiskFree))" <= 0
|head 1| table _time,lower95(prediction(DiskFree)),full_result
Essentially I need the host, drive (instance), lower95(diskfree) and _time values in the output of my search. Feel free to post your suggestions if you have better search options in mind. Thank You!
Regards,
tafzal
