Hi, I'm creating a simple chart that displays disk space but Predict doesn't handle a step change very well. When space is filling up it successfully predicts but if any space has been freed up and these a sharp change in the data, Predict freaks out.
index=perfmon sourcetype="Perfmon:LogicalDisk" host=xxxxx counter="Free Megabytes" instance=E:
| timechart span=24h max(Value) usenull=f | predict max(Value) future_timespan=90
Also can it be run against multiple host or disks?
Cheers
Not quite sure what you mean by "freaks out" (picture might help?)
I'll have a stab at this though:
Predict uses LLP5, which includes "seasonality" (recurring patterns),
try feeding it more historical data and/or tune the period, this should average things out,
you might want to change to "LLT" instead of you don't want seasonality at all?
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Predict#Predict_options