How do I run forecast time series multiple times using one search?

[mtmoore]

I want to run a forecast time series multiple times using one search on the remaining freespace of a number of our databases (data collected on within Splunk) — in this case, around 900 with 5 days worth of historical data — predicting whether the freespace will run below 60% in the next 90 days. I can use the map command, but it just times out after about an hour... any suggestions?

sourcetype="mysource" | stats count by Database| map search="search sourcetype=mysource Database=$Database$   |  timechart span=24h avg(MainPercFree)  | fit ARIMA _time avg(MainPercFree) order=1-0-0 forecast_k=90 holdback=0 conf_interval=95 as prediction |where prediction < 60 | stats earliest(_time) as First |eval Database=$Database$" maxsearches=900 |eval First=strftime(First,"%+")

[493669]

This blog series will help you and try using machine learning toolkit for prediction -

• https://www.splunk.com/blog/2018/01/19/cyclical-statistical-forecasts-and-anomalies-part-1.html

• https://www.splunk.com/blog/2018/02/05/cyclical-statistical-forecasts-and-anomalies-part-2.html

• https://www.splunk.com/blog/2018/03/20/cyclical-statistical-forecasts-and-anomalies-part-3.html

[mtmoore]

I'm afraid those articles don't show how to predict values on multiple fields of data 😞