https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119513#M32076 <P>works... thanks..</P> Tue, 31 Mar 2015 18:05:58 GMT sundaresh83 2015-03-31T18:05:58Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119508#M32071 <P>Hi,</P> <P>I am writing a search: </P> <PRE><CODE>timechart span=1h sum(Bytes) AS "MBytes " </CODE></PRE> <P>In the same search, I want it to return Mb instead of bytes ie. bytes/1000000.<BR /> So I tried: </P> <PRE><CODE>stats sum(eval in_mB =Bytes/1000000) as "MBytes" </CODE></PRE> <P>But just <CODE>eval in_mB =Bytes/1000000</CODE> works. Can I store this as a column for future use instead of rewriting it? How do I do it? </P> Tue, 31 Mar 2015 17:15:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119508#M32071 sundaresh83 2015-03-31T17:15:14Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119509#M32072 <P>Hi sundaresh83</P> <P>What if you just do the eval conversion separately before the timechart?</P> <PRE><CODE>(your base search) | eval in_mB=Bytes/1000000 | timechart span=1h sum(in_mB) as "MBytes" </CODE></PRE> Tue, 31 Mar 2015 17:35:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119509#M32072 ppablo 2015-03-31T17:35:37Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119510#M32073 <P>Hi,</P> <P>Try with:</P> <PRE><CODE> | eval megabytes=((bytes/1024)/1024) | timechart sum(megabytes) </CODE></PRE> Tue, 31 Mar 2015 17:38:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119510#M32073 Patient 2015-03-31T17:38:27Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119511#M32074 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/188962">@ppablo</a>_splunk <BR /> This will work, but I do now want it to return the "in_mB value and the sum value. <BR /> I want my query to return only the sum value in MB. </P> Mon, 28 Sep 2020 19:22:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119511#M32074 sundaresh83 2020-09-28T19:22:01Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119512#M32075 <P>Hi!</P> <P>have you tried with the above search query?</P> Tue, 31 Mar 2015 17:47:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119512#M32075 Patient 2015-03-31T17:47:14Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119513#M32076 <P>works... thanks..</P> Tue, 31 Mar 2015 18:05:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119513#M32076 sundaresh83 2015-03-31T18:05:58Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119514#M32077 <P>works... thanks...</P> Tue, 31 Mar 2015 18:06:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119514#M32077 sundaresh83 2015-03-31T18:06:11Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119515#M32078 <P>Hi!<BR /> Note that 1Mb=1024*1024 Bytes</P> Tue, 31 Mar 2015 18:09:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119515#M32078 Patient 2015-03-31T18:09:07Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119516#M32079 <P>Thank you for your vote!</P> Tue, 31 Mar 2015 18:11:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119516#M32079 Patient 2015-03-31T18:11:51Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119517#M32080 <P>yup, @Patient's calculation below will be more accurate</P> Tue, 31 Mar 2015 18:16:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-bytes-to-megabytes-for-use-in-my-timechart-search/m-p/119517#M32080 ppablo 2015-03-31T18:16:18Z