Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I run forecast time series multiple times using one search?

$
0
0
I want to run a forecast time series multiple times using one search on the remaining freespace of a number of our databases (data collected on within Splunk) — in this case, around 900 with 5 days worth of historical data — predicting whether the freespace will run below 60% in the next 90 days. I can use the map command, but it just times out after about an hour... any suggestions? sourcetype="mysource" | stats count by Database| map search="search sourcetype=mysource Database=$Database$ | timechart span=24h avg(MainPercFree) | fit ARIMA _time avg(MainPercFree) order=1-0-0 forecast_k=90 holdback=0 conf_interval=95 as prediction |where prediction < 60 | stats earliest(_time) as First |eval Database=$Database$" maxsearches=900 |eval First=strftime(First,"%+")

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>