https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459332#M129667 <P>You may want to use stats instead of Top as it does other logic. I did something a little different:</P> <P>search<BR /> | eval MB=(BYTES/1024)<BR /> | eval GB=(MB/1024)<BR /> | stats sum(GB) by host</P> Wed, 15 May 2019 13:47:49 GMT jodyfsu 2019-05-15T13:47:49Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459331#M129666 <P>my proxy is capturing three fields such as bytes,bytes_in and bytes_out out of which in need to calculate total bandwidth utilization for onemonth. I have framed the below query<BR /> index=Proxy site="XXX"|eval BW= ((bytes_in+bytes_out)/1024)/1024 <BR /> where I am adding both indound and outbound data and then converting it into Megabytes and after that the values are displaying as below<BR /> Top 10 Values Count %<BR /><BR /> 0.06401729583740234 710 1.86%<BR /><BR /> 0.0640115737915039 533 1.396%<BR /><BR /> 0.06404876708984375 493 1.292%<BR /><BR /> 0.06402873992919922 475 1.244%<BR /><BR /> 0.06401443481445312 428 1.121%<BR /><BR /> 0.38465213775634766 390 1.022%<BR /><BR /> 0.06403446197509766 345 0.904%<BR /> But I need it to be displayed in numeric values only and it should be MB's or GB's and it should also give me overall bandwidth for onemonth</P> Wed, 30 Sep 2020 00:34:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459331#M129666 vellas78 2020-09-30T00:34:29Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459332#M129667 <P>You may want to use stats instead of Top as it does other logic. I did something a little different:</P> <P>search<BR /> | eval MB=(BYTES/1024)<BR /> | eval GB=(MB/1024)<BR /> | stats sum(GB) by host</P> Wed, 15 May 2019 13:47:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459332#M129667 jodyfsu 2019-05-15T13:47:49Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459333#M129668 <P>Hi Jodyfsu,<BR /> Thank you for the search query simplification. since i have 3 fields such as bytes,bytes_in and bytes_out but in the above search it only bytes/1024, does it mean bytes will capture the total data of both incoming and outgoing? secondly the final one stats sum(GB) so i don't want it to group by either user or host i just wanted to get total Banwidth so doing stats sum(GB) will give the over all BandWidth i think. Kindly correct me if I am wrong on any of thing explained above.</P> Wed, 30 Sep 2020 00:34:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459333#M129668 vellas78 2020-09-30T00:34:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459334#M129669 <P>Hey Vellas78, in my logs I only have the bytes so you may need to do the addition for your data.</P> <P>| eval MB=((bytes_in+bytes_out)/1024)<BR /> | stats sum(MB) </P> Wed, 30 Sep 2020 00:34:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459334#M129669 jodyfsu 2020-09-30T00:34:37Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459335#M129670 <P>I understood that you are trying to get total bandwidth utilization for 1 month.<BR /> <STRONG>Query</STRONG><BR /> index=Proxy site="XXX"<BR /> | eval IO_bytes= (bytes_in+bytes_out)/1024<BR /> | eval Bytes=(bytes/1024)<BR /> | eval Total_bytes= if(IO_bytes=Bytes, Bytes,Total_bytes)<BR /> | table Bytes Total_bytes</P> Wed, 30 Sep 2020 00:34:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-Total-Bandwidth-Usage-using-bytes-bytes-in-and/m-p/459335#M129670 vikramyadav 2020-09-30T00:34:39Z