Looking to start using Splunk to do trending and forecasting (predict).
index=os sourcetype=cpu host=ukdc1-xxx-xxx* earliest=-1w | eval Total=(pctSystem+pctUser) | timechart avg(Total) span=1h | predict Total future_timespan=168 algorithm=LL
Getting the old 'Too few data points' error.
This works, but i need the two cpu fields added together to get the total amount of CPU busy time...
index=os sourcetype=cpu host=ukdc1-xxx-xxx* earliest=-1w | timechart avg(pctSystem) span=1h AS AVG | predict AVG future_timespan=168 algorithm=LL
I think you have a typo in your failing line. It looks like you mean:
... | timechart avg(Total) span=1h AS Total | ...
View solution in original post
That did it!
The lower95 line is dropping to -25, can this be contained as -25% CPU utilization isn't really possible?