Splunk Search

Predict error in time chart

codedtech
Path Finder

I'm working on a query that predicts GB growth, I keep getting "command="predict", Unknown field after eval". Here is the query I'm using:
MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict GB as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24

0 Karma

renjith_nair
Legend

@codedtech,

In your timechart you are adding GB field and creating field Volume. So use Volume field in your predict command

MyIndex|eval GB=BYTES/1024/1024/1024|timechart sum(GB) as Volume|predict Volume as growth algorithm=LLP5 lower40=low upper40=high future_timespan=24 
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...