What are some of the "best practices" for utilizing Splunk's prediction algorithms?

[sdorich]

I'm kind of new to using Splunk's built-in statistical algorithms. The following search works but is VERY inefficient (it takes 5+ minutes to even see the results). However, I know that these algorithms are complex so maybe this is "normal" but I wanted to see if the Splunk community knew of a way to make this search/computation more efficient. Thanks in advance.

eventtype=sitescope_cpu | timechart span=1m max(Value) as max_cpu | predict max_cpu | rename max_cpu as "Maximum CPU", prediction(max_cpu) as Prediction

[sanjay_shrestha]

If it is possible then using time range criteria (earliest, latest) might help to expedite search.

[sanjay_shrestha]

Your search looks good to me. It would be helpful to create summary index in the situation when query is taking longer than desired time and populate that with savedsearch in regular interval.

[sdorich]

Well I've tried many ranges but the performance isn't excellent. Obviously the shorter the time range the faster the search but I was just checking with the Splunk community for suggestions regarding my actual search (i.e. can this search be any more efficient or is this the best possible way to get the results I want?)