Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out. index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E: | timechart span=24h max(Value) usenull=f | predict max(Value) future_timespan=90 Also can it be run against multiple host or disks? Cheers ... View more

index=ABC source="ABC" ServiceName=ABC | stats distinct_count(CorrelationId) as TotalA | appendcols [search "TokenStatus=*Success*" ServiceName=ABC | stats distinct_count(CorrelationId) as TotalSuccess ]| appendcols [search TokenSubStatus=*error* ServiceName=ABC | stats distinct_count(CorrelationId) as TotalFailure ]| eval Total=(TotalSuccess*100)/TotalA | fields Total I have been given the above query to troubleshoot and i've already pulled my hair out. I can see that line 4 is not required but this always returns 0. Let's say TotalA is 100 & TotalSuccess is 10 I would expect the output to = 10% or at least 10. Am I missing something simple? Cheers ... View more

I had 2 custom dashboards that have now gone 'missing'. I know that i haven't deleted them, is there any way back from this abyss? Cheers ... View more

Hi, I have a radial gauge with TPS metrics being displayed and refreshing every minute. Each refresh redraws the whole gauge within the panel. Is there a way to just redraw the tick or the arm of the gauge, like a real gauge would do? ... View more

I'm creating what at first seemed a simple search criteria, but here goes... I have multiple servers and displaying CPU by host, but also scanning each server's log file for transaction numbers. I need to display the CPU stats by host, but add all the transactions and have that sum overlaying the CPU area graph. Hope you're still with me and here is my code so far (sanitized)... index=os OR index= (sourcetype=cpu OR sourcetype=) host= source=/opt/ OR TXN="Elapsed time for this payment" | multikv fields pctSystem | timechart span=5m count(TXN) avg(pctSystem) Cheers Splunkers ... View more