So finally worked out how to do it, was a knowledge gap on my part. I didn't understand the "." option in the eval command to concatenate a string with a calculated value, and the sub search returning it all as an option/variable to the predict command. Below is an example, generating prediction of data ingest through to the end of the current day. index=_internal source=license_usage.log type=Usage earliest=@d | eval gb=b/1024/1024/1024 | reverse | accum gb as totalb | timechart last(totalb) span=1m as tc_totalb | predict tc_totalb algorithm=LLT holdback=1 [| gentimes start=-1 | eval search="future_timespan=".round((relative_time(now(),"+1d@d")-now())/60) | table search] AS predicted_usage | eval upper95(predicted_usage)=if(_time<=now(), predicted_usage, 'upper95(predicted_usage)' ) | eval lower95(predicted_usage)=if(_time<=now(), predicted_usage, 'lower95(predicted_usage)' ) | rename tc_totalb as "Data Ingested" ... View more