I'm working on a query that predicts GB growth, I keep getting "command="predict", Unknown field after eval". Here is the query I'm using:
MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict GB as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24
@codedtech,
In your timechart you are adding GB field and creating field Volume
. So use Volume
field in your predict command
MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict Volume as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24