Predict stops working when eval used

[rob3770]

Hi,

Looking to start using Splunk to do trending and forecasting (predict).

index=os  sourcetype=cpu   host=ukdc1-xxx-xxx* earliest=-1w | eval Total=(pctSystem+pctUser) | timechart avg(Total)  span=1h | predict Total future_timespan=168 algorithm=LL

Getting the old 'Too few data points' error.

This works, but i need the two cpu fields added together to get the total amount of CPU busy time...

index=os  sourcetype=cpu   host=ukdc1-xxx-xxx* earliest=-1w | timechart avg(pctSystem) span=1h AS AVG | predict AVG future_timespan=168 algorithm=LL

[aweitzman · Accepted solution]

I think you have a typo in your failing line. It looks like you mean:

... | timechart avg(Total) span=1h AS Total | ...

[rob3770]

That did it!

The lower95 line is dropping to -25, can this be contained as -25% CPU utilization isn't really possible?

Cheers