I tried various combinations but failed
index="flowintegrator" src_port=21
|eval thisUser=src_ip + "="+ dest_ip
| timechart avg(bytes) as volume by
thisUser|predict thisUser
index="flowintegrator" src_port=21
|eval thisUser=src_ip + "="+ dest_ip
| timechart avg(bytes) as avg_bytes
by thisUser|predict avg_bytes
This works but I can't predict.
index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser
Help
See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".
ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・
See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".
ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・
thank you HIroshi-san,
|predict 127.0.0.1_127.0.0.2 works
However, the thisUser is dynamic, how can I pass this range of thisUser to predict? If this is not possible, I will mark your answer as correct.
If you look at the predict manual you can not use wildcards in the field list.
So I think that dynamic designation can not be done.
ex.
predict <field-list>
table <wc-field-list>
sounds good to me. I will find another way to do my alert. arigato gozaimasu
just thought of something, given my date span is per 7 days, i can rename the ipUser.
|rename "127*" as ip* |predict ip1, ip2, ip3, ip4, ip5, ip6, ip7
Thanks for the inspiration. (y)
forgot to mention about the error in predict
e.g.
Command: predict, unknown field: avg_bytes