topic Re: convert bytes to megabytes in report in Splunk Search

convert bytes to megabytes in report

jxjackso — Tue, 13 Jul 2010 22:24:24 GMT

Hello.

I'm building a report with the following query:

sourcetype="access_combined" dmanager | timechart sum(bytes)

Which works, but I want to convert the bytes to megs. I tried sum(bytes/1024) but got an error when I tried this.

Any help is much appreciated.

Re: convert bytes to megabytes in report

Simeon — Tue, 13 Jul 2010 22:46:01 GMT

You can use the eval command to make changes to values:

sourcetype="access_combined" dmanager | eval megabytes=((bytes/1024)/1024) | timechart sum(megabytes)

This will also work without the parenthesis:

... | eval megabytes=bytes/1024/1024 |

For more detail:

http://www.splunk.com/base/Documentation/latest/SearchReference/Eval

Re: convert bytes to megabytes in report

ziegfried — Wed, 14 Jul 2010 03:16:02 GMT

Here is a little search macro that does a little more than just converting a value to megabytes - it formats the value depending on its size in GB, MB, KB or bytes. Not usable for chart, but when displaying top-lists it comes quite handy.

The definition looks like this:

if($bytes$>1073741824, tostring(round($bytes$/1073741824,2))+" GB", if($bytes$>1048576, tostring(round($bytes$/1048576,2))+" MB", if($bytes$>1024, tostring(round($bytes$/1024))+" KB", tostring($bytes$)+" Bytes")))

with the argument bytes and can be used like this:

sourcetype=access_combined | stats sum(bytes) as volume by uri | sort -volume | head 10 | eval volume=`format_bytes(volume)`

which would print out smth like:

              uri                       volume
------------------------------------- ---------
/url1                                  1.54 GB
/url2                                  656.34 MB
/url3                                  474.46 MB
/url4                                  291.72 MB
/url1                                  62.84 MB
/url1                                  26.08 MB
...

Re: convert bytes to megabytes in report

Paolo_Prigione — Wed, 14 Jul 2010 03:31:51 GMT

on 4.x you should also be able to put it all into the "timechart" command:

... | timechart eval(sum(bytes)/1024/1024) as totMBs

Re: convert bytes to megabytes in report

RohiniJindam — Thu, 27 Jun 2013 13:28:14 GMT

Any workaround for displaying the numbers in the above format in charts?

Re: convert bytes to megabytes in report

tb5821 — Tue, 17 Sep 2013 13:17:24 GMT

How does one go about setting this up as a search macro? Looking for some step by step directions.

Re: convert bytes to megabytes in report

sowings — Mon, 28 Sep 2020 14:47:28 GMT

In the example above, the macro is called in the search as "format_bytes", with one argument. This means that the stanza in macros.conf (or Manager -> Advanced Search -> Search macros) as format_bytes(1). The text of the macro is the first one with all of the math. The argument (as identified by the term that keeps repeating as $bytes$) is bytes. The $ $ surrounding it in the macro definition mean "place the text of the argument here."