Splunk Search
Highlighted

predict per host

Explorer

There are already some similar questions here, but we're not getting to an answer so far.
We would like to predict when the Free Disk Space counter is below a certain value for each host in the index.
An example for one host can be written and alerted on as follows:

index=perfmon host=server1 instance="D:" sourcetype="Perfmon:sqlserverhost:logicaldisk_daily" counter="% Free Space" 
| timechart min(Value) as "Free Space" 
| predict "Free Space" AS p_free_space algorithm=LLP5 future_timespan=180 
| where p_free_space<=5 
| sort _time 
| head 1 | fields _time host

The map command should give us the possibility to do this for multiple hosts, but we're missing something:

index=perfmon (host=server1 OR host=server2) 
| dedup host 
| map [search index=perfmon host=$host$ instance="D:" sourcetype="Perfmon:sqlserverhost:logicaldisk_daily" counter="% Free Space" 
| timechart min(Value) as "Free Space" 
| predict "Free Space" AS p_free_space algorithm=LLP5 future_timespan=180 
| where p_free_space<=5 ]

Anybody who can tell what we're missing...?
Thanks!

0 Karma
Highlighted

Re: predict per host

Splunk Employee
Splunk Employee

Hi,

Did you looked into MLTK new algorithm StateSpaceforecast which supports multivariate? Checkout the blog below for more information:https://www.splunk.com/blog/2019/03/20/what-s-new-in-the-splunk-machine-learning-toolkit-4-2.html

Also, we have now new alerts for Machine learning which can be used in your usecase. Checkout the documentation on statespace forecast here : https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#StateSpaceForecast

Thanks,

0 Karma