https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135016#M36918 <P>I am researching how to track spikes in bandwidth to see if individuals are using the network to for personal time like conducting personal business during lunch. From your answer above, have you any advice or experience to track bandwidth using Active Directory IDs rather than hardware types/routers?</P> Thu, 29 Jun 2017 14:54:07 GMT rickettw 2017-06-29T14:54:07Z https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135013#M36915 <P>When trying to figure out bandwidth, which search string makes more sense?</P> <P><SEARCH> | eval MBs=(bytes*8/1024/1024) | timechart sum(MBs) as "MB/s"</SEARCH></P> <P>or</P> <P><SEARCH> | eval MBs=(bytes*8/1024/1024) | chart sum(MBs) as "MB/s" by _time</SEARCH></P> Wed, 09 Jul 2014 13:46:52 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135013#M36915 albyva 2014-07-09T13:46:52Z https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135014#M36916 <P>You're trying to find bandwidth at a fixed interval? The timechart provides 'span' options without any extra line (a bucket command will be required for chart), so I will go for timechart.</P> Wed, 09 Jul 2014 13:57:26 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135014#M36916 somesoni2 2014-07-09T13:57:26Z https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135015#M36917 <P>Thanks for the incite about chart and needing a bucket. I think I'll stick with Timechart. Typically it is a fixed interval like 2hrs, 12hrs, or 24hrs.</P> Wed, 09 Jul 2014 14:00:06 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135015#M36917 albyva 2014-07-09T14:00:06Z https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135016#M36918 <P>I am researching how to track spikes in bandwidth to see if individuals are using the network to for personal time like conducting personal business during lunch. From your answer above, have you any advice or experience to track bandwidth using Active Directory IDs rather than hardware types/routers?</P> Thu, 29 Jun 2017 14:54:07 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-vs-Chart-time-to-figure-out-bandwidth/m-p/135016#M36918 rickettw 2017-06-29T14:54:07Z