Dashboards & Visualizations

Predict query using multiselect - HELP

bimord
Path Finder

I have a dynamic dashboard timechart that is being fed by user inputs that is having trouble working with my predict query.
I currently have something close to 1500 hosts to accomodate and am only requiring the prediction query to occur when the 'OTHER' field appears ($hosts$ defaults to *)

I want to be able to :
see the lowest 10 hosts and an aggregate of all other hosts with a future-only prediction when no selection is made -- working with my below query
AND
for the graph to still draw when selected hosts are inputted (1-many with no 'OTHER' field present) -- NOT WORKING

Here is what i have so far:

index=blah sourcetype=blah $hosts$
timechart median(blah) as Blah by host WHERE min in bottom10
| eval predictOrNot=if(isnotnull(OTHER),OTHER,$hosts$)
| predict predictOrNot as Prediction future_timespan=50
| eval Prediction=if(_time<=relative_time(now(),"-1w"), null, 'Prediction')

I'm attempting to achieve the following or some other workaround:

if (OTHER is not null)
    { run prediction query using 'OTHER' }
else 
    { run prediction query using $hosts$ } -- currently working if only 1 host selected but multiple is not working

Any help would be greatly appreciated 🙂

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...