Splunk Search

How to edit my timechart search to predict when the Top N subnets will run out of Free addresses?

New Member
  • Currently, my line chart is showing predict vales for the given subnets i.e when the subnets will run out of Free address (Time in month and year)
  • And my input for example as 'default/'.
  • The chart shows time in X-Axis and "Free addresses" in Y-Axis.

My current requirement is instead of input network ('default/'), we need to take a new input filter 'Top N'

  • So, we need to predict when the Top N subnets will run out of Free addresses.
  • The top N lines will show lines for Top N subnets whose free address will exhaust first. Each line will represent the subnet.
  • I tried the foreach command, but not able to apply the predict. Looks like foreach command is basically doing some operations on certain field sets, mainly evals, not sure where can we apply that with the current requirement. Any suggestions please.

my search string is something like below:

| eval Free=address_total-dhcp_hosts
| stats max(Free) as Free by _time  view_network
| timechart  max(Free) as "Free Addresses"
| forecast "Free Addresses" future_timespan=150 as Prediction

Appreciate if any suggestions/ideas on how to achieve this.

0 Karma


Try streamstats to set the value of free IPS at the time and use predict to look ahead.

0 Karma


like predict don't think this can be done see here

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...