01-24-2018 12:07 PM
I have been attempting to modify the built in IPAM Prediction Dashboard to give good future predictions with my IPAM and Range data. With my static server subnets that grow at a fairly steady rate the built-in report seems to give fairly good data as written, however, so does the Splunk predict function.
When I turn IPAM Prediction Dashboard it lose on a DHCP range with a short lease time and huge daily variability, it gives completely random predictions as written.
The first change was to get rid of the “top” feature. The chances of the network or range I’m interested in being in the top 10 when we have thousands is not very likely. Even with thousands of ranges, the pull-down menus populate in a second or two. The next change was to look at MAX over time instead of AVG. When the DHCP range runs between 10% and 90% every day, and you go back over any length of time the average utilization over 24 hours is not what you are worried about hitting, once the MAX hits 100% at any time, you have an outage. I’m not sure why average was taken here. It seems like EMM is the function that should be doing this work.
I still wasn’t getting great data, so I added span=1d on the timechart commands. This worked and I started getting better data but then again, with that data the predict function also works fairly well.
I found Infoblox Patent application for EMM and the one blog post on Infoblox.com but neither were really much help on tweaking the inheritance and window size (and lookup table???) to make it work for DHCP ranges.
Could we get an example of a DHCP range prediction using EMM that will correctly predict a DHCP range that has an increasing peak utilization M-F but goes to near zero over night?
MAX M-F week 1 ~60%
MAX M-F week 2 ~65%
MAX M-F week 3 ~70%
This data would be a nice sine wave each day with less utilization on the weekends. It appears to me that EMM should smooth this data out, and looking back over the last 3 weeks tell me that next month, I’m going to hit 100% at some point during the production day.
Or is that not what EMM is meant to do and just looking at the MAX each day with the built in predict function is a simpler solution?
Also, is there more documentation on EMM and the related lookup tables and functions somewhere?