Dashboards & Visualizations

How to create a predictive forecast for capacity consumption, then display in a Trellis dashboard, grouped by the value of one of the fields in the dataset

bulletprooffool
New Member

I have spent a few hours trying to solve this and viewing the forum, but no luck so far.

I have a single dataset containing a chunk of data.
I am trying to create a predictive forecast for capacity consumption - but I'd like to display this in a Trellis dashboard, grouped by the value of one of the fields in the dataset.
My data is quite consistent.

This is as close as I can get:

index="my_data" source="capacityStats" | timechart span=7d   max(machinesAllocatedPercentage) as Machines, max(storageGBAllocatedPercentage) as Storage, max(memoryGBAllocatedPercentage) as Memory | predict Machines, Storage, Memory

The problem is that this is a total average of ALL data and predictions, therefore.
My data maps to multiple capacity sources.
If I amend my query to:

index="my_data" source="capacityStats" | timechart span=7d   max(machinesAllocatedPercentage) as Machines, max(storageGBAllocatedPercentage) as Storage, max(memoryGBAllocatedPercentage) as Memory by CapacitySource

Then I can drill down and display my statistics using the Trellis feature, simply by Selecting 'CapacitySource' in the 'Split By' Option for the Trellis.
Seemingly, I am unable to do this in combination with the Predict analysis?

Does anyone know of a workaround?
Creating separate dashboards manually for each Capacity source won't suffice since I will occasionally get new ones, or lose old ones - and I need the dashboard to be self-maintaining.

I appreciate any help.

0 Karma

bulletprooffool
New Member

I am starting to think this is not possible...

0 Karma

to4kawa
Ultra Champion

Trellis needs stats/chart by just before.
after predict, you should aggregate.

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...