https://community.splunk.com/t5/Getting-Data-In/report-on-counters/m-p/49901#M9483 <P>For network bytes, it can make sense to show the two values together on a graph. Try a variation on the below search, make it a stacked area chart, and see if you like the results. (Subsearches are often pretty slow, and I try to avoid them.)</P> <P><PRE><CODE><BR /> host=stbackup06 counter="Bytes Sent/sec" OR counter="Bytes Received/sec" | timechart avg(Value) as Avg by counter <BR /> </CODE></PRE></P> Fri, 11 May 2012 20:43:48 GMT cphair 2012-05-11T20:43:48Z https://community.splunk.com/t5/Getting-Data-In/report-on-counters/m-p/49900#M9482 <P>I am trying to create a report of network bytes from the Universal Forwarder, WMI is not an option for me. Here is an excerpt of the fields</P> <P>5/11/12<BR /> 8:30:42.863 AM </P> <P>05/11/2012 08:30:42.863<BR /> collection="Network Interface"<BR /> object="Network Interface"<BR /> counter="Bytes Sent/sec"<BR /> instance="HP NC7782 Gigabit Server Adapter _3"<BR /> Value=2578.7604252584738</P> <PRE><CODE>host=STBACKUP06 Options| sourcetype=Perfmon:Network Interface Options| source=Perfmon:Network Interface Options </CODE></PRE> <P>3 » 5/11/12<BR /> 8:30:42.863 AM </P> <P>05/11/2012 08:30:42.863<BR /> collection="Network Interface"<BR /> object="Network Interface"<BR /> counter="Bytes Received/sec"<BR /> instance=isatap.redmond.corp.microsoft.com<BR /> Value=1523.9033187413756</P> <PRE><CODE>host=STBACKUP06 Options| sourcetype=Perfmon:Network Interface Options| source=Perfmon:Network Interface Options </CODE></PRE> <P>The counter's are different but they both use the word Value for data and I tried to use a search to join these and it failed.</P> <P>source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host[search source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec) </P> <P>I ended up with no data. What am I missing?</P> Mon, 28 Sep 2020 11:48:45 GMT https://community.splunk.com/t5/Getting-Data-In/report-on-counters/m-p/49900#M9482 mlevenson 2020-09-28T11:48:45Z https://community.splunk.com/t5/Getting-Data-In/report-on-counters/m-p/49901#M9483 <P>For network bytes, it can make sense to show the two values together on a graph. Try a variation on the below search, make it a stacked area chart, and see if you like the results. (Subsearches are often pretty slow, and I try to avoid them.)</P> <P><PRE><CODE><BR /> host=stbackup06 counter="Bytes Sent/sec" OR counter="Bytes Received/sec" | timechart avg(Value) as Avg by counter <BR /> </CODE></PRE></P> Fri, 11 May 2012 20:43:48 GMT https://community.splunk.com/t5/Getting-Data-In/report-on-counters/m-p/49901#M9483 cphair 2012-05-11T20:43:48Z