Run predict command for multiple disk in same query

[RSS_STT]

I have multiple disk like C, D & E on server and want to do the prediction for multiple disk in same query.

index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180

Could anyone help with modified query.

[livehybrid]

Hi @RSS_STT 

The predict command can take a number of fields, such as in this example below, allowing you to run the predict against all your drives.

| makeresults count=5
| streamstats count
| eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:")
| eval Value = case(instance=="C:", 90 - count*5, instance=="D:", 80 - count*4, instance=="E:", 70 - count*3)
| append [| makeresults count=5
| eval _time = relative_time(now(), "-1h")
| streamstats count
| eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:")
| eval Value = case(instance=="C:", 880 - count*5, instance=="D:", 82 - count*4, instance=="E:", 70 - count*3)]
| fields _time, instance, Value
| timechart min(Value) as "FreeSpace" by instance
| fillnull "C:" "D:" "E:"
| predict "C:" "D:" "E:" algorithm=LLP5 future_timespan=180

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ITWhisperer]

Assuming instance contains the disk you want to predict, you could try something like this

index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" 
| eval instance=substr(instance,0,1)
| timechart min(value) as "Used Space" by instance
| appendpipe
    [| fields _time C
    | where isnotnull(C)
    | predict C algorithm=LLP5 future_timespan=180]
| appendpipe
    [| fields _time D
    | where isnotnull(D)
    | predict D algorithm=LLP5 future_timespan=180]
| appendpipe
    [| fields _time E
    | where isnotnull(E)
    | predict E algorithm=LLP5 future_timespan=180]