How to calculate 'days-till-full' on storage dashboard?

[wordy]

Hi all,

I'm very new to Splunk, but have had some success using Dashboard Studio to display storage aggregate capacity.

I have a SizeUsed field which gives me the % full of the aggregate at various points in time.  I have set the queryParameters to earliest="-365d", and latest="now".

This is the search I am using to display the current % full in a SingleValue chart.  

index="lgt_netapp_prod"  source type="netapp:aggregate:csv"  Name="type_ctry_2000_h01_n01_fsas_02"
| timechart last(SizeUsed) span=3d

I also have an Area chart on the same dashboard showing the growth mapped out over 12 months.

I would like to calculate the number of days till the aggregate is full, using the daily growth rate of the aggregate over a 12 month period.

The logic for this, could be something like:

dailyGrowth = (last(SizeUsed) - first(SizeUsed))/365

capacityRemaining = 100 - last(SizeUsed)

daysTillFull = capacityRemaining / dailyGrowth

Unfortunately, I havent been able to figure out the syntax which would allow me to use the values in this way, and then display the result in a chart.

Is it possible someone could point me in the right direction here?  It would be a real feather in my cap if I could make this work for my employers.

Cheers.....

[richgalloway]

Try this approach.

| stats first("last(SizeUsed)") as firstSize, last("last(SizeUsed)") as lastSize
| eval capacityRemaining = 100 - lastSize
| eval daysTillFull = capacityRemaining / dailyGrowth

I have doubts about how well growth over 365 days will predict how soon maximum capacity will be reached.  Since growth typically is not linear, a spike in growth could cause the capacity to be reached sooner than predicted by the daily average.

[wordy · Accepted solution]

many thanks for the response.... the below worked for me 👍

**************************************

| stats earliest("SizeUsed") as firstSize, latest("SizeUsed") as lastSize

| eval capacityRemaining = 100-lastSize

| eval dailyGrowth = (lastSize-firstSize)/365

| eval daysTillFull = round(capacityRemaining/dailyGrowth,0)

| eval daysTillFull = if(daysTillFull < 0, "n/a", daysTillFull)

| table daysTillFull