https://community.splunk.com/t5/Monitoring-Splunk/calculate-nic-interface-throughput/m-p/25969#M6794 <P>Below is the search from the *nix app for interface throughput, but I have a question regarding the eval command for the timechart. Does the “dc(time)” indicate that we are dividing by the timeframe in seconds? Example: For a 60 min timeframe are we dividing by 3600 seconds?</P> <P>How do I calculate duration, when _time is the only value available?</P> <P>timechart eval(sum(TX_Thruput_KB)/dc(time))</P> <P>index="os" sourcetype="interfaces" host=* | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | timechart eval(sum(TX_Thruput_KB)/dc(time)) by Interface_Host</P> Mon, 28 Sep 2020 13:16:52 GMT ericca 2020-09-28T13:16:52Z https://community.splunk.com/t5/Monitoring-Splunk/calculate-nic-interface-throughput/m-p/25969#M6794 <P>Below is the search from the *nix app for interface throughput, but I have a question regarding the eval command for the timechart. Does the “dc(time)” indicate that we are dividing by the timeframe in seconds? Example: For a 60 min timeframe are we dividing by 3600 seconds?</P> <P>How do I calculate duration, when _time is the only value available?</P> <P>timechart eval(sum(TX_Thruput_KB)/dc(time))</P> <P>index="os" sourcetype="interfaces" host=* | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | timechart eval(sum(TX_Thruput_KB)/dc(time)) by Interface_Host</P> Mon, 28 Sep 2020 13:16:52 GMT https://community.splunk.com/t5/Monitoring-Splunk/calculate-nic-interface-throughput/m-p/25969#M6794 ericca 2020-09-28T13:16:52Z https://community.splunk.com/t5/Monitoring-Splunk/calculate-nic-interface-throughput/m-p/25970#M6795 <P>solution provided by Ron Naken<BR /> old - timechart eval(sum(TX_Thruput_KB)/dc(time)) by Interface_Host <BR /> new - timechart per_second(RX_Thruput_mbits) by Interface_Host </P> <P>Full search:<BR /> index="os" sourcetype="interfaces" <BR /> | multikv fields name, inetAddr, RXbytes, TXbytes <BR /> | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name <BR /> | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host <BR /> | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 <BR /> | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 <BR /> | eval RX_Thruput_mbits=(RX_Thruput_KB)<EM>.0078125 <BR /> | eval TX_Thruput_mbits=(RX_Thruput_KB)</EM>.0078125 <BR /> | timechart per_second(RX_Thruput_mbits) by Interface_Host </P> Mon, 28 Sep 2020 13:16:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/calculate-nic-interface-throughput/m-p/25970#M6795 ericca 2020-09-28T13:16:59Z