Splunk Search
Highlighted

How do I run forecast time series multiple times using one search?

Explorer

I want to run a forecast time series multiple times using one search on the remaining freespace of a number of our databases (data collected on within Splunk) — in this case, around 900 with 5 days worth of historical data — predicting whether the freespace will run below 60% in the next 90 days. I can use the map command, but it just times out after about an hour... any suggestions?

sourcetype="mysource" | stats count by Database| map search="search sourcetype=mysource Database=$Database$   |  timechart span=24h avg(MainPercFree)  | fit ARIMA _time avg(MainPercFree) order=1-0-0 forecast_k=90 holdback=0 conf_interval=95 as prediction |where prediction < 60 | stats earliest(_time) as First |eval Database=$Database$" maxsearches=900 |eval First=strftime(First,"%+")
0 Karma
Highlighted

Re: How do I run forecast time series multiple times using one search?

Super Champion
0 Karma
Highlighted

Re: How do I run forecast time series multiple times using one search?

Explorer

I'm afraid those articles don't show how to predict values on multiple fields of data 😞

0 Karma