Splunk Search

Why is the predict command projecting past dates in the future?

ajtalbot1
Engager

What I thought was going to be a simple search:

lucy
| eval UsedT=UsedMB/1024/1024 
| eval UsedTB=round(UsedT,1) 
| timechart avg(UsedTB) as TBUsed span=1w 
| predict TBUsed

But my graph is showing the current data, up to today (March 28th), then jumping back to February 1st.alt text
Any ideas?

0 Karma

ajtalbot1
Engager

Root cause was found. Turns out everything gets screwed up if there is missing data. In this case my data set was only about 90 days, and I was search for 120 days. The null data at the beginning screwed everything up.

0 Karma

DalJeanis
Legend

Please accept your answer so that the question will show as complete.

0 Karma

gfreitas
Builder

Odd.. could you post also the results table?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...