Splunk Search

Extend finite fields into the future in conjunction with the predict command

burras
Communicator

I'm attempting to build out a capacity chart that shows total elements used in a system and predicts the future count of elements. My basic search is:

index=foo sourcetype=bar |eval capacity=250000 |eval threshold=200000 |timechart span=1d max(capacity), max(threshold), sum(elements) as current |predict currant as Forecast future_timespan=90

The search itself works great - the only issue is that capacity and threshold lines stop at today's date. Is there a way to extend those lines without having to manually specify an extension of 90 days in the timerange? Manually specifiying a date 90 days in the future seems to distort the display of the upper and lower 90 predictions.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this. Since capacity and threshold are hard-coded values added to each row, their max will always be same as original hardcoded value.

index=foo sourcetype=bar  |timechart span=1d sum(elements) as current |predict currant as Forecast future_timespan=90 |eval capacity=250000 |eval threshold=200000

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You are probably getting no results because you are calculating "current" and then asking splunk to predict "currant".

It has no dried grapelike fruits in the database to predict from.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this. Since capacity and threshold are hard-coded values added to each row, their max will always be same as original hardcoded value.

index=foo sourcetype=bar  |timechart span=1d sum(elements) as current |predict currant as Forecast future_timespan=90 |eval capacity=250000 |eval threshold=200000
0 Karma

burras
Communicator

Beautiful - that did it. Thanks for the assist!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...