Splunk Search

Run predict command for multiple disk in same query

RSS_STT
Explorer

I have multiple disk like C, D & E on server and want to do the prediction for multiple disk in same query.

index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180

Could anyone help with modified query.

 

 

Labels (1)
Tags (1)
0 Karma

livehybrid
Super Champion

Hi @RSS_STT 

The predict command can take a number of fields, such as in this example below, allowing you to run the predict against all your drives.

| makeresults count=5
| streamstats count
| eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:")
| eval Value = case(instance=="C:", 90 - count*5, instance=="D:", 80 - count*4, instance=="E:", 70 - count*3)
| append [| makeresults count=5
| eval _time = relative_time(now(), "-1h")
| streamstats count
| eval instance = case(count%3==1, "C:", count%3==2, "D:", true(), "E:")
| eval Value = case(instance=="C:", 880 - count*5, instance=="D:", 82 - count*4, instance=="E:", 70 - count*3)]
| fields _time, instance, Value
| timechart min(Value) as "FreeSpace" by instance
| fillnull "C:" "D:" "E:"
| predict "C:" "D:" "E:" algorithm=LLP5 future_timespan=180

 

livehybrid_0-1746437121904.png

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming instance contains the disk you want to predict, you could try something like this

index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" 
| eval instance=substr(instance,0,1)
| timechart min(value) as "Used Space" by instance
| appendpipe
    [| fields _time C
    | where isnotnull(C)
    | predict C algorithm=LLP5 future_timespan=180]
| appendpipe
    [| fields _time D
    | where isnotnull(D)
    | predict D algorithm=LLP5 future_timespan=180]
| appendpipe
    [| fields _time E
    | where isnotnull(E)
    | predict E algorithm=LLP5 future_timespan=180]
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...