topic Bandwidth from IIS Logs in Splunk Search

Bandwidth from IIS Logs

chca — Tue, 02 Oct 2012 22:30:49 GMT

I'm using a a timechart (I presume that is the correct method) to display the bandwidth sent by IIS per minute for video files. So far this is what I have:

(flv OR mp4 OR mov OR wmv) AND /hosted | timechart span=1m avg(cs_bytes)

This returns a one-minute table, but the averages for the bytes are blank. Any ideas?

UPDATE
I'm thinking that I also need to incorporate the IIS field "time_taken", to know how long it took for this event to complete. What I need to setup bucket increments, then determine how many buckets any given event takes to complete. Then divide the bytes sent by the number of buckets, and use that to sum up the amount of bytes per bucket. Easy. 😜 Ack.

Re: Bandwidth from IIS Logs

lguinn2 — Tue, 02 Oct 2012 22:35:42 GMT

Are you sure that the field name is cs_bytes?

Do you get events if you just search for

(flv OR mp4 OR mov OR wmv) AND /hosted

Re: Bandwidth from IIS Logs

chca — Wed, 03 Oct 2012 18:46:03 GMT

Yes, that field is listed in the "Other Interesting Fields." And yes, I get results as expected without the timechart; it shows me a total number of hits per bucket.

Re: Bandwidth from IIS Logs

chca — Wed, 03 Oct 2012 20:11:38 GMT

I just realized I had a small issue with the source, so now I'm getting the results as expected. I don't think it's quite accurate though; as-written, it presumes that all data is sent within the smallest bucket. As noted above, I need to take into account for time_taken.