Extend finite fields into the future in conjunction with the predict command

[burras]

I'm attempting to build out a capacity chart that shows total elements used in a system and predicts the future count of elements. My basic search is:

index=foo sourcetype=bar |eval capacity=250000 |eval threshold=200000 |timechart span=1d max(capacity), max(threshold), sum(elements) as current |predict currant as Forecast future_timespan=90

The search itself works great - the only issue is that capacity and threshold lines stop at today's date. Is there a way to extend those lines without having to manually specify an extension of 90 days in the timerange? Manually specifiying a date 90 days in the future seems to distort the display of the upper and lower 90 predictions.

[DalJeanis]

You are probably getting no results because you are calculating "current" and then asking splunk to predict "currant".

It has no dried grapelike fruits in the database to predict from.

[somesoni2 · Accepted solution]

Try like this. Since capacity and threshold are hard-coded values added to each row, their max will always be same as original hardcoded value.

index=foo sourcetype=bar  |timechart span=1d sum(elements) as current |predict currant as Forecast future_timespan=90 |eval capacity=250000 |eval threshold=200000

[burras]

Beautiful - that did it. Thanks for the assist!