Splunk Search

Predict: show past events and future predictions

nplamondon
SplunkTrust
SplunkTrust

I'm using predict, and seeing good results, but I would like to clean up my visualization.

What I would like is to see past data and future predicted data with no overlap.

Using eval predicted=if(isnull(foo), predicted, null()), I am able to show predicted data only where actual data points don't exist, but I still see the upper95 and lower95 overlaid on top of actual data. Trying an equivalent eval for "lower95(predicted)" doesn't work.

Is there a way I can show only actual data where it exists, and only predicted data (with probability ranges) where it doesn't?

0 Karma
1 Solution

nplamondon
SplunkTrust
SplunkTrust

Good news, everybody!

This was entirely a PEBKAC issue. Working on this more today, I found the "Null values" option under formatting. No idea how I had missed that previously. Setting "Null values" to "connect" made the leading zeroed line disappear.

Thanks, again, for your help, Rich and Clara!

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...