Splunk Search

Predict error in time chart

codedtech
Path Finder

I'm working on a query that predicts GB growth, I keep getting "command="predict", Unknown field after eval". Here is the query I'm using:
MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict GB as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@codedtech,

In your timechart you are adding GB field and creating field Volume. So use Volume field in your predict command

MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict Volume as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24 
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...