topic Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router? in Getting Data In

how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Tue, 29 Sep 2020 07:00:56 GMT

Trying to calculate the percentage bandwidth utilization on each link -How can I achieve that?

index=snmp dst_device="mdf1" src_device="mdf2" |delta _time as period | eval transferedBitsIn=snmpIfInOctets*8/period | eval transferedBitsOut=snmpIfOutOctets*8/period | timechart span=5s sum(transferedBitsIn) as Input sum(transferedBitsOut) as output by source

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

jtrucks — Tue, 18 Aug 2015 18:56:48 GMT

Can you show examples of the source event data?

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

sajbutler — Wed, 19 Aug 2015 02:35:10 GMT

Hi bidahor13

A couple of observations:
1. It looks like the transferedBitsIn and transferedBitsOut fields are calculating a per second value. If this the case, then using average would be more appropriate than sum in your timechart
2. If you want to calculate a percentage utilisation, then you need to divide bandwidth used by bandwidth total

It would be a good to get a sample of data so we can give more specific pointers

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Wed, 19 Aug 2015 20:56:30 GMT

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Wed, 19 Aug 2015 20:56:35 GMT

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Tue, 29 Sep 2020 07:05:26 GMT

index=snmp | eval link=if(src_device previousIn , currentIn, previousIn) | eval current1_Out = if( currentOut > previousOut , currentOut, previousOut) | eval current2_In = (maxValue + current1_In)/period | eval current2_Out = (maxValue + current1_Out)/period | eval transferredBitsIn_kByte=round((current2_In)/1000 ,1) | eval transferredBitsOut_kByte=round((current2_Out)/1000,1) | timechart span=48s avg(transferredBitsOut_kByte) AS Tx_OUT avg(transferredBitsIn_kByte) AS Tx_IN by link | eval Tx_OUT = round(Tx_OUT,1) | eval Tx_IN = round(Tx_IN , 1)

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Wed, 19 Aug 2015 21:02:21 GMT

Made some changes on my last SPL - does the data search look accurate to generate the bandwidth data and bits transferred by each link? If sit does- how do i calculate the percentage utilization for each link?

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Wed, 19 Aug 2015 21:02:40 GMT

See the snap shot below:

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

sajbutler — Wed, 19 Aug 2015 21:29:18 GMT

Sorry, I can't see the link below. Its a broken link for me

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Thu, 20 Aug 2015 16:09:56 GMT

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

woodcock — Thu, 20 Aug 2015 20:51:37 GMT

Your link "works" but shows a useless image.

How much is this related to this other question?

http://answers.splunk.com/answers/289809/how-to-calculate-bandwidth-utilization-on-an-snmp.html

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Thu, 20 Aug 2015 21:23:12 GMT

not related!

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

sajbutler — Thu, 20 Aug 2015 23:07:54 GMT

Getting a HTTP Status 403 error when clicking on the link

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Thu, 20 Aug 2015 23:08:32 GMT

hi sajbutler - I just sent you the link .Let me know if it helps thanks.

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

Richfez — Thu, 20 Aug 2015 23:52:03 GMT

Given your search, since that's all I can see, I can make a few remarks on how to accomplish this.

One method is to do some math directly in the timechart command. In this case, something like this might work:

...| timechart span=5s sum(transferedBitsIn) as Input, sum(transferedBitsOut) as output, eval(sum(transferedBitsIn)/100000000) as Percentage_in by source

Or, create a new field with the value, then use that.

...| eval Max_Bandwidth=100000000 | timechart span=5s sum(transferedBitsIn) as Input, sum(transferedBitsOut) as output, eval(sum(transferedBitsIn)/sum(Max_Bandwidth)) as Percentage_in by source

In either case, you'll have to provide your own values, and probably do a little cleanup on making it show up right. My GUESS is that you'll actually need eval(sum(transferedBitsIn)/avg(Max_Bandwidth)) instead of sum(Max_Bandwidth), but with the problems seeing your raw data (or even a sample), I'm not sure.

One final caveat, I probably did my division backwards. 🙂

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

bidahor13 — Fri, 21 Aug 2015 15:20:06 GMT

lol..thanks rich7177, I will try it out.

Re: how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

Richfez — Sat, 22 Aug 2015 00:26:23 GMT

You might also have access to something like the snmp OID for ifSpeed (I believe 1.3.6.1.2.1.2.2.1.5, but could be slightly elsewhere). If you have that, and it reflects the connection speed, you could use that instead of creating your own "Max_Bandwidth". It's worth a look.