Splunk Search

How do I add fields to output from predict

chengka
Explorer

I need to locate and alert on counts that are not within predicted bounds. It seems simple enough using predict, but predict does not include any information regarding the source. Here is a run anywhere search which illustrates my concern

index=_internal sourcetype=splunkd_access* | timechart span=1d count as Gets | predict Gets | eval queueManager=if(1=1, mq_ir360_qmgr,"no") | rename upper95(prediction(Gets)) as ceiling | rename lower95(prediction(Gets)) as floor | eval excession=if(Gets > ceiling, "100", "0") | eval recession=if(Get < floor, "-100", "0") | table _time Gets, sourcetype

As you can see, there is no mention of the sourcetype in the results. I plan to use this within a map loop to check thousands of different hosts and I need to know which host contains an outlier. I tried to add information, but it is not in the pipe, so I can't(see second example) .

How would I get the sourcetype in my output?

alt text

0 Karma
1 Solution

sundareshr
Legend

I believe the reason you don't see the sourcetype is because of the timechart command. Try including the sourcetype field as an output to that command. Something like this may work

... |  timechart span=1d first(sourcetype) as sourcetype count as Gets | predict Gets | table _time Gets sourcetype

View solution in original post

0 Karma

sundareshr
Legend

I believe the reason you don't see the sourcetype is because of the timechart command. Try including the sourcetype field as an output to that command. Something like this may work

... |  timechart span=1d first(sourcetype) as sourcetype count as Gets | predict Gets | table _time Gets sourcetype
0 Karma

chengka
Explorer

That worked. Thank you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...