topic Re: How to gather user bandwidth for specify url? in Splunk Dev

How to gather user bandwidth for specify url?

cmndata1 — Wed, 06 Mar 2019 04:00:07 GMT

Hi all,

Thanks all for spending time to my case.

I would like to list out a table to show the user web browsing log.
For example, what url they will go when they are surfing splunk.com

Table would like to be like that.

Do you guys has any idea?

Re: How to gather user bandwidth for specify url?

renjith_nair — Thu, 07 Mar 2019 02:48:18 GMT

@cmndata1 ,
You might need to provide more details for us to help you better.
What's the source of data ? What kind of events do you have now? Do you have the specified fields in your events?

In general it would be

     index="your index" source="your firewall source" | stats sum(rcvdbyte) as rcvd,sum(sentbyte) as sent by url
     |eval bandwidth=rcvd + sent

Re: How to gather user bandwidth for specify url?

cmndata1 — Thu, 07 Mar 2019 08:32:27 GMT

@renjith.nair
Thank you so much.
I would like to give you some fields that is useful.

Date (e.g Mar 7)
Time (e.g 14:00:00)
User (e.g Tom_Chan)
hostname (e.g www.google.com)
url
sentbyte (could it transform to MB?)
rcvdbyte (could it transform to MB?)
srcip(user source IP)

index would be fgt_utm
The firewall is sending log to splunk.
For ideal case, i would like to list out how many bandwidth did the user spend on each url.

Thanks!

Re: How to gather user bandwidth for specify url?

renjith_nair — Thu, 07 Mar 2019 09:40:50 GMT

Probably you can start with below and lets know what changes you need. If you may added additional group by clause (Date,srcip etc)

index=fgt_utm "your other filters for sourcetype"
|eval bandwidthMb=((sentByte/1000000)+(rcvdbyte /1000000))
|stats sum(bandwidthMb) as BandwidthUsed by User,url,host