variable to control the value of `future_timespan` in the predict function?

[HattrickNZ]

Is there a way I can use a variable to control the value of future_timespan in the predict function?

I have tried this approach:
timechart span=d max(kpi1) as kpi1| eval x =808 |
predict kpi1 as kpi1 future_timespan=x holdback=1 |

So what I am thinkisg is there would be some input type that would control the variable for future_timespan. Any idea if this can be achieved?

[gwobben · Accepted solution]

Why not use a token directly?

timechart span=d max(kpi1) as kpi1 | predict kpi1 as kpi1 future_timespan=$your_timespan$ holdback=1

Just make a text input with the token name your_timespan and you should be good to go...

[HattrickNZ]

ye, maybe your right. tks

[rvencu]

Hi, this is still good for manual control. What about predicting earnings to end of current month based on previous values? Everyday the end of current month is a day closer. I tried to use a formula and a subsearch but everytime I get errors that future_timespan=xxx is invalid

[gwobben]

Sure you can, though it's not pretty, and not very easy. I've got 2 examples, please note that these examples are based on 1h timespans (!)

(1) The hard but exact way (calculate the time until the end of the month, divide it by the span, and then use the calculated value as the future_timespan)

| noop | stats count | eval end_of_month = relative_time(now(), "@mon+1mon") | eval now = now() | eval difference_seconds = end_of_month - now | eval difference_hours = difference_seconds / 3600 | eval difference = round(difference_hours, 0)
| map search="search index=_internal | timechart span=1h count | predict count future_timespan=$difference$"
| table _time *

(2) The brute force way (predict too much, remove anything you don't need)

index=_internal | timechart span=1h count | predict count future_timespan=744 | eval end_of_month = relative_time(now(), "@mon+1mon") | where _time<=end_of_month | fields - end_of_month

[rvencu]

Thanks. There is a great answer to that here: https://answers.splunk.com/answers/443865/predict-values-by-end-of-current-month.html#answer-443874