CPU Usage Prediction of later 15 days... of a month

[singh3and12]

Hi, I am trying to create a dashboard that shows % CPU Processor time avg (Value)..but the query i used to only giving me future values for 3 to 4 hrs of predicted values only.. but i need it to show for alteast 15 days. could you please help me out with query.

the query i am using

index=main earliest=-5d sourcetype="Perfmon:CPU Load" counter="% Processor Time"
|timechart span=5min avg(Value) as "CPU Processor Time" |predict "CPU Processor Time" AS "Predicted value"
algorithm=LLP5 upper95=high lower95=low holdback=30 future_timespan=70

[singh3and12 · Accepted solution]

Hi ,

Thanks for your quick response , Though MLTK is good options.. but it would useful, if we get purpose done using predict command itself.. since i am bit new to splunk... could you please help me out what can i modify in this query to get result as cpu processor predicted values atleast for span as 10 days.

[tom_frotscher]

You can use this search:

index=main earliest=-5d sourcetype="Perfmon:CPU Load" counter="% Processor Time"
|timechart span=5min avg(Value) as "CPU Processor Time" |predict "CPU Processor Time" AS "Predicted value"
algorithm=LLP5 upper95=high lower95=low future_timespan=2880

But it could be hard for the algorithm to figure out a good prediction for 10 days and more in the future, when the history of your search is only 5 days (earliest=-5d). Use a larger time span and try to play around with the different algorithms the predict commands offer and try to use the predict option "period", which adds seasonal information to the prediction. You can take a look in the documentation for predict: https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Predict

It is hard to give you more details to improve your search, since predictions are always individually and modelled according to your historic data, which i do not know.

Greetings

Tom

[singh3and12]

thanks .. 🙂

[tom_frotscher]

Hi,

you use future_timespan=70, which means 70 * 5 min is predicted into the future, since you are calculating 5min buckets with timechart. Also you have configured holdback=30, which means you are not using the last 30*5min for your prediction. If you just want to predict more points in future increase future_timespan and do not use holdback.

For an even better prediction, try out the new algorithm in the machine learning toolkit "StateSpaceForecast".

You can see an example of usage here: https://www.splunk.com/blog/2019/03/20/what-s-new-in-the-splunk-machine-learning-toolkit-4-2.html

In short, it makes better use of seasonal pattern, like weekends, holidays, time of the day. Which is typically applicable for CPU usage.

Greetings

Tom