https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438092#M174054 <P>i would like to get the total bandwidth used by a particular subnet in my network, please help, i am new in splunk, </P> Mon, 17 Dec 2018 14:31:45 GMT ikaneng 2018-12-17T14:31:45Z https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438092#M174054 <P>i would like to get the total bandwidth used by a particular subnet in my network, please help, i am new in splunk, </P> Mon, 17 Dec 2018 14:31:45 GMT https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438092#M174054 ikaneng 2018-12-17T14:31:45Z https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438093#M174055 <P>we might need more details like how your field=values look like, and what's your sample search you started with. </P> Mon, 17 Dec 2018 17:19:50 GMT https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438093#M174055 prakash007 2018-12-17T17:19:50Z https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438094#M174056 <P>hi prakash007, can you suggest a basic search that I can try out, totally new in this thing, </P> Tue, 18 Dec 2018 09:37:22 GMT https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438094#M174056 ikaneng 2018-12-18T09:37:22Z https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438095#M174057 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/155109">@ikaneng</a>: how's your raw data look like, we need more details to come up with a search...<BR /> If it's a ipv4 you can have this in your base search, you might have to use cidrmatch for ipv6...</P> <P>e.g: index=index_name sourcetype=stype subnet_ip=10.0.0.1/24 | stats count, max(connsbyHost) as max_bandwidth, min(connsbyHost) as min_bandwidth, avg(connsbyHost) as avg_bandwidth BY Interface</P> <P>go though this splunk docs for reference..<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions#max.28X.29" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions#max.28X.29</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/ConditionalFunctions#cidrmatch.28.22X.22.2CY.29" target="_blank">http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/ConditionalFunctions#cidrmatch.28.22X.22.2CY.29</A></P> Tue, 29 Sep 2020 22:30:17 GMT https://community.splunk.com/t5/Splunk-Search/i-would-like-to-get-the-total-bandwidth-used-by-a-particular/m-p/438095#M174057 prakash007 2020-09-29T22:30:17Z