Splunk Search

timechart avg(bytes) by... not working with predict

erickyi
Path Finder

I tried various combinations but failed

  1. index="flowintegrator" src_port=21
    |eval thisUser=src_ip + "="+ dest_ip
    | timechart avg(bytes) as volume by
    thisUser|predict thisUser

  2. index="flowintegrator" src_port=21
    |eval thisUser=src_ip + "="+ dest_ip
    | timechart avg(bytes) as avg_bytes
    by thisUser|predict avg_bytes

This works but I can't predict.
index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser

Help

0 Karma
1 Solution

HiroshiSatoh
Champion

See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".

ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・

View solution in original post

HiroshiSatoh
Champion

See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".

ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・

erickyi
Path Finder

thank you HIroshi-san,
|predict 127.0.0.1_127.0.0.2 works
However, the thisUser is dynamic, how can I pass this range of thisUser to predict? If this is not possible, I will mark your answer as correct.

0 Karma

HiroshiSatoh
Champion

If you look at the predict manual you can not use wildcards in the field list.
So I think that dynamic designation can not be done.

ex.

predict <field-list>
table <wc-field-list>
0 Karma

erickyi
Path Finder

sounds good to me. I will find another way to do my alert. arigato gozaimasu

0 Karma

erickyi
Path Finder

just thought of something, given my date span is per 7 days, i can rename the ipUser.
|rename "127*" as ip* |predict ip1, ip2, ip3, ip4, ip5, ip6, ip7

Thanks for the inspiration. (y)

0 Karma

erickyi
Path Finder

forgot to mention about the error in predict
e.g.
Command: predict, unknown field: avg_bytes

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...