This is a minor update I have been meaning to post for quite a few weeks now.

Series Decompose Forecast has been introduced and in my mind it makes the trend for disk (and other data points) easier to code and to view.

// Dec 2018 option, using Series_decompose_forecast

//

// Project disk capacity forward nn days

let myComputer = "DC02";

let myDriveLetter = "C:";

let startDate = startofday(ago(60d)); // go back in time nn days

let endDate = now(); // what is the date now

let projectTo = now()+30d; // project forward nn days

let projectForward = 30; // must be same as projectTo value

Perf

| where TimeGenerated between (startDate .. endDate )

| where Computer startswith myComputer

| where CounterName == "% Free Space" and InstanceName has myDriveLetter

| make-series DiskFreeSpace = avg(CounterValue) default=0 on TimeGenerated in range(startDate, projectTo, 1h)

| extend DiskFreeSpaceForecast = series_decompose_forecast(DiskFreeSpace, projectForward*24)

| render timechart

You can see, that the blue line is the past 60days (drops to zero for today) and the green line is the prediction from today onwards to 30days.  You can edit the options for how many days to go back and how many to predict forward in the LET statements.