Splunk Search

timechart avg(bytes) by... not working with predict

erickyi
Path Finder

I tried various combinations but failed

  1. index="flowintegrator" src_port=21
    |eval thisUser=src_ip + "="+ dest_ip
    | timechart avg(bytes) as volume by
    thisUser|predict thisUser

  2. index="flowintegrator" src_port=21
    |eval thisUser=src_ip + "="+ dest_ip
    | timechart avg(bytes) as avg_bytes
    by thisUser|predict avg_bytes

This works but I can't predict.
index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser

Help

0 Karma
1 Solution

HiroshiSatoh
Champion

See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".

ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・

View solution in original post

HiroshiSatoh
Champion

See the result of timechart.Field name is wrong.
Since predict can not use wildcards, you must specify all field names.
However, since "=" can not be used, please change it to "_".

ex.
|predict "127.0.0.1_127.0.0.2" "127.0.0.1_127.0.0.3" "127.0.0.1_127.0.0.4" ・・・

erickyi
Path Finder

thank you HIroshi-san,
|predict 127.0.0.1_127.0.0.2 works
However, the thisUser is dynamic, how can I pass this range of thisUser to predict? If this is not possible, I will mark your answer as correct.

0 Karma

HiroshiSatoh
Champion

If you look at the predict manual you can not use wildcards in the field list.
So I think that dynamic designation can not be done.

ex.

predict <field-list>
table <wc-field-list>
0 Karma

erickyi
Path Finder

sounds good to me. I will find another way to do my alert. arigato gozaimasu

0 Karma

erickyi
Path Finder

just thought of something, given my date span is per 7 days, i can rename the ipUser.
|rename "127*" as ip* |predict ip1, ip2, ip3, ip4, ip5, ip6, ip7

Thanks for the inspiration. (y)

0 Karma

erickyi
Path Finder

forgot to mention about the error in predict
e.g.
Command: predict, unknown field: avg_bytes

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...