topic Re: bandwidth utilization percentage in Splunk Search

bandwidth utilization percentage

ayomotukoya — Tue, 25 Mar 2025 18:48:18 GMT

I have the below search and I want to modify it to get the bandwidth utilization percentage. Whats the best way to go about that and what should I add to my search?

index=snmp sourcetype=snmp_attributes Name=ifHCInOctets host=xyz
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsIn=delta*8/1024/1024
| append
[search index=snmp sourcetype=snmp_attributes Name=ifHCOutOctets host=xyz
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsOut=delta*8/1024/1024 ]
| search UID=1
| timechart span=5m per_second(mbpsIn) AS MbpsIn per_second(mbpsOut) AS MbpsOut BY UID

Re: bandwidth utilization percentage

PickleRick — Tue, 25 Mar 2025 23:04:48 GMT

1. How do you define percentage?

2. You're overthinking your search with this append thingy. You should search for both Names and streamstats by Name. Append uses subsearch and it has its limitations so you might be getting wrong results and not even knowing it.

Re: bandwidth utilization percentage

ayomotukoya — Wed, 26 Mar 2025 06:12:44 GMT

Percentage of bandwidth utilized. I’m thinking bytes in+bytes out/1024 then I’m stumped from there

Re: bandwidth utilization percentage

PickleRick — Wed, 26 Mar 2025 06:22:27 GMT

Yes but percentage is counted from a value against some bigger total. What would be the total in your case?

Re: bandwidth utilization percentage

ayomotukoya — Wed, 26 Mar 2025 06:59:44 GMT

10 mbs

Re: bandwidth utilization percentage

ayomotukoya — Wed, 26 Mar 2025 07:00:25 GMT

10 mb

Re: bandwidth utilization percentage

PickleRick — Wed, 26 Mar 2025 07:50:05 GMT

Ah, so if it's a static value, you just do something like

| eval inpercentage=Mbpsin/10*100

(or (10*1024*1024), or whatever static value you calculate it against; didn't check your scale). No magic here.

Re: bandwidth utilization percentage

ayomotukoya — Wed, 26 Mar 2025 10:05:27 GMT

When I run the search I dont get a field for Bytesinpercentage

index=snmp sourcetype=snmp_attributes Name=ifHCInOctets host=a154
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsIn=delta*8/1024/1024
| append
[search index=snmp sourcetype=snmp_attributes Name=ifHCOutOctets host=a154
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsOut=delta*8/1024/1024 ]
| search UID=1
| timechart span=5m per_second(mbpsIn) AS MbpsIn per_second(mbpsOut) AS MbpsOut BY UID
| eval Bytesinpercentage=MbpsIn/10*1024*1024

Re: bandwidth utilization percentage

PickleRick — Wed, 26 Mar 2025 11:08:24 GMT

Ahhh... right. It's timechart with a BY clause so you'll have separate series for each UID. So if there is a small, fixed set of those UIDs you can do separate eval for each of those fields; you have to adjust the names of course. (If you have too many series your timechart will get clogged anyway).

Alternatively you can loop over those fields with a foreach command.

Re: bandwidth utilization percentage

ayomotukoya — Wed, 26 Mar 2025 11:33:24 GMT

Spl isn’t really my strong suit. Would you mind showing me how you’d do it for this UID?

Re: bandwidth utilization percentage

PickleRick — Wed, 26 Mar 2025 12:10:46 GMT

Well, you have this

| search UID=1

part in your search which means that you're effectively getting just two series in output.

And if you want the data for just this UID, it's best to filter your data as early as possible so that Splunk doesn't drag all unnecessary data along just to filter most of it out at the end. So you can completely refactor your search to something like.

index=snmp sourcetype=snmp_attributes Name IN (ifHCInOctets,ifHCOutOctets) host=xyz UID=1
| streamstats current=t global=f window=2 range(Value) AS delta BY  Name
| eval mbps=delta*8/1024/1024
| timechart span=5m per_second(mbps) AS Mbps BY Name

This should give you two series as output - ifHCInOctets and ifHCOutOctets.

You can of course

| rename ifHCInOctets as In, ifHCOutOctets as Out

for brevity.

And now you can just do

| eval InPerc=In/(10*1024*1024)
| eval OutPerc=Out/(10*1024*1024)

You can multiply it by 100 if you want actual percents.