How to keep predict format when re-evaluating low to 0

[aohls]

I am looking to track the volume of how often users access specific areas of an application. What I am finding is the lower limit goes negative, which I do not want. I reset this to 0 if it below 0 but when doing so I lose how the visualization looks for the traditional prediction command; I no longer get the shaded area with the prediction line. I get four individual lines for the chart. Is there any way to force the normal predict visual to be shown?

|timechart span=1h count as Vol
|predict Vol as PredictedVol algorithm=LLP5 upper90=high lower95=low holdback 4 future_timespan=8
|rename low(PredictedVol) as low, high(PredictedVol) as high
|eval low=if(low,0,low)

[Richfez · Accepted solution]

It isn't your resetting below zero that does this, it's your rename.

I think the Line Chart does something special when it sees values like low(foo) and high(foo), things it does ONLY if it sees fields that look exactly like that. So when you renamed, the fields are no longer recognized as those special ones.

Try

|timechart span=1h count as Vol
|predict Vol as PredictedVol algorithm=LLP5 upper90=high lower95=low holdback 4 future_timespan=8
|eval low(PredictedVol)=if('low(PredictedVol)'<0,0,'low(PredictedVol)')

(Also note that I fixed the actual logic in 'if', and used single-quotes around the mishmashed field-with-parenthesis so they're interpreted as fields, not as ... something else. )

That should answer your question, I hope!

Happy Splunking,

Rich

Addendum that's not really part of the question:

The above realization made me take a second look - could one simply name fields like 'low(fieldname)' and 'high(fieldname)' where fieldname is a field that exists, and eval those to some random number of your choosing and have line chart do the predict-style chart?

That answer is No.  Sadly, it appears you both have to have a predict and also the fields named precisely correctly. 

Though at least it doesn't seem to care if you did the eval for all the fields.  Which means, though I'm pretty sure it's nearly useless, you could do something like this:

|timechart span=1h count as Vol
|predict Vol as PredictedVol algorithm=LLP5 upper90=high lower95=low holdback 4 future_timespan=8
|eval low(PredictedVol)=1, PredictedVol = 7, high(PredictedVol) = 19