predict future_timespan value as a calculated variable

[danan5]

Hi,
I am trying to use the predict function to predict hourly values through to the end of the current day. To do this I need to pass to the future_timespan option a decreasing number as the day progresses. ie at midday future_timespan = 12, at 3pm future_timespan=9 etc.

I have some fairly ugly eval statements that give me a value of the number of hours remaining in the current day, however, I don't see how I can pass a value back to the command as a variable.

Any hints greatly appreciated.
David

[danan5 · Accepted solution]

So finally worked out how to do it, was a knowledge gap on my part. I didn't understand the "." option in the eval command to concatenate a string with a calculated value, and the sub search returning it all as an option/variable to the predict command.

Below is an example, generating prediction of data ingest through to the end of the current day.

index=_internal source=license_usage.log type=Usage earliest=@d | eval gb=b/1024/1024/1024
| reverse
| accum gb as totalb
| timechart last(totalb) span=1m as tc_totalb
| predict tc_totalb algorithm=LLT holdback=1 [| gentimes start=-1 | eval search="future_timespan=".round((relative_time(now(),"+1d@d")-now())/60) | table search] AS predicted_usage
| eval upper95(predicted_usage)=if(_time<=now(), predicted_usage, 'upper95(predicted_usage)' )
| eval lower95(predicted_usage)=if(_time<=now(), predicted_usage, 'lower95(predicted_usage)' )
| rename tc_totalb as "Data Ingested"