topic Re: How to find total byte count? in Splunk Search

How to find total byte count?

DEAD_BEEF — Thu, 02 Apr 2015 22:51:41 GMT

I am looking through my firewall logs and would like to find the total byte count between a single source and a single destination. There are multiple byte count values over the 2-hour search duration and I would simply like to see a table listing the source, destination, and total byte count.

I've tried stats and eventstats but nothing seems to work right.

Current query:

index=fw_log src_ip=1.2.3.4 dst_ip=5.6.7.8 | eventstats sum(bytes) AS "Total Bytes" by src_ip | table src_ip,dst_ip,"Total Bytes"

What I want is:

    src_ip     dst_ip   Total Bytes
    1.2.3.4    5.6.7.8  94782161

What I'm getting is:

    src_ip     dst_ip   Total Bytes
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882

Re: How to find total byte count?

sideview — Mon, 28 Sep 2020 19:24:45 GMT

index=fw_log src_ip=1.2.3.4 dst_ip=5.6.7.8 | stats sum(bytes) AS "Total Bytes" by src_ip dst_ip

That will give you the one row. You don't want to use eventstats here, but rather its bigger brother stats. Stats with a "by foo" or "by foo bar", will output one row for every unique combination of the "by" fields. Eventstats however, will output pretty much exactly the same rows that it received from the prior command, except that it will have tacked on a couple extra fields that it computed in various ways.

If you want to see all pairs of src_ip and dst_ip, that would be

index=fw_log  | stats sum(bytes) AS "Total Bytes" by src_ip dst_ip

Re: How to find total byte count?

DEAD_BEEF — Thu, 02 Apr 2015 23:12:28 GMT

Not sure how I missed this, thank you!

Re: How to find total byte count?

velthias — Mon, 20 Jan 2020 16:04:36 GMT

How do you convert the Total Bytes into mb or gb from this search?

Re: How to find total byte count?

to4kawa — Mon, 20 Jan 2020 17:16:53 GMT

index=fw_log  
| stats sum(bytes) AS Total_Bytes
sum(eval(round(bytes/1024))) AS Total_Bytes_MB
sum(eval(round(bytes/1024/1024))) AS "otal_Bytes_GB by src_ip dst_ip

 index=fw_log  
| stats sum(bytes) AS Total_Bytes by src_ip dst_ip
| eval Total_Bytes_MB= round(Total_Bytes/1024)
| eval Total_Bytes_GB=round(Total_Bytes/1024/1024)