topic Re: Converting MB to GB in Dashboards & Visualizations

Converting MB to GB

kesrich — Thu, 25 Jun 2020 18:48:03 GMT

Hi, I am very new to Splunk reporting and I am trying to change a timechart I have to show in GB since we are using a 4TB disk share. Below is my search query. It comes up OK, but just trying to make it more friendly.

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14| timechart span=24h avg(Free_Megabytes) as MB_Free

Thanks

Kesrich

Re: Converting MB to GB

richgalloway — Thu, 25 Jun 2020 19:49:08 GMT

Use eval to convert the values.

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14 | eval GB_Free = Free_Megabytes/1024 | timechart span=24h avg(GB_Free) as GB_Free

Re: Converting MB to GB

MattibergB — Thu, 25 Jun 2020 19:51:39 GMT

You could try to use the following before your timechart: | eval GB_Free=(Free_Megabytes/1024).

Then change your timechart to the following:

| timechart span=24h avg(GB_Free) as GB_Free

Re: Converting MB to GB

niketn — Fri, 26 Jun 2020 16:45:50 GMT

Actually reverse perform timechart to get daily data hoping even if you are querying 1 year of data it will be 365 rows. Then apply eval

index=perfmon host=ServerName eventtype=perfmon_windows NetShare14 | timechart span=24h avg(Free_Megabytes) as GB_Free | eval GB_Free=round(GB_Free,2)

Read more about eval command in Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval

Re: Converting MB to GB

kesrich — Mon, 29 Jun 2020 15:23:48 GMT

Thanks everyone for the suggestions. I wasn't familiar with "eval". That helped.