topic Re: windows perfmon network utilization in Splunk Search

windows perfmon network utilization

ggfsplunk — Sun, 14 Feb 2021 02:59:10 GMT

I'm trying to figure out to calculate the network utilization on this server using the eval and stats and I'm having problem figuring out the correct search and expression, can you help me.

index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=*
| eval bytes_out = "Bytes Sent/sec", bytes_in = "Bytes Received/sec"
| eval Bandwidth = bytes_out + bytes_in
| timechart count by Bandwidth limit=10

I need to convert the bytes in mbps, as well, I would really appreciate some help here, Thank you in advance.

Re: windows perfmon network utilization

lydiapal_splunk — Sun, 14 Feb 2021 05:26:30 GMT

Hi!

Something like this should help you:

index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=* | eval bytes_out=if(counter="Bytes Sent/sec",Value,0), bytes_in=if(counter="Bytes Received/sec",Value,0) | eval bandwidth_mbps=(bytes_out+bytes_in)/1024/1024 | timechart avg(bandwidth)

Please replace index=* with your index name, as it is bad practise to use index=*.

I'd strongly suggest doing the free Splunk Fundamentals 1 course, it will help you understand basic SPL better.

Re: windows perfmon network utilization

ggfsplunk — Sun, 14 Feb 2021 05:50:07 GMT

Thank you so much, search works, just slight modification on last pipe | timechart avg(bandwidth_mpbs)...

Re: windows perfmon network utilization

lydiapal_splunk — Sun, 14 Feb 2021 06:58:26 GMT

Happy to help! Sorry for the typo.. 😅

Re: windows perfmon network utilization

snehalharshe16 — Thu, 01 Apr 2021 15:05:20 GMT

Hey

Run PerfMon from any command line (or type "Performance Monitor" in the Start menu), right-click on "Performance", select "Connect to another computer", and enter the IP address of the Nano Server computer you want to monitor.