Once you have your base cost per day query, you can then add this to do a predictive panel.. [...] | timechart span=1d count(status) as "Error Status Count" | predict "Error Status Count" future_timespan=7 where [...] is your base query and replace 7 with the amount of days you want to predict. This would allow you to take into account changes in the already ingested data .... ... View more

%F <=> %Y-%m-%d %T <=> %H:%M:%S Please check your source is there eight or nine digits and use based on that %8N or %9N otherwise this didn't work. ... View more

There should at least be a display name option so you don't have to keep the username as the only visible thing since it can't be changed. ... View more

I was reading this: https://answers.splunk.com/answers/62185/where-to-install-splunk-for-jmx-app-in-a-distributed-splunk-env.html It seems we have to deploy the app on the server that the forwarder is setup as well? But that is not stated in the app documentation: https://splunkbase.splunk.com/app/668/#/documentation Can you please elaborate on that a bit? From the reading I've done it seems we have things setup properly on the Splunk side and have networking allowances in place. The only thing I can see is that on the forwarder there is not a SPLUNK4JMX app installed. ... View more

Anytime, let me know if you have any issues setting it up. ... View more