topic Re: Data normalization for bandwidth from Mbps to Gbps in Splunk Search

Data normalization for bandwidth from Mbps to Gbps

sswansonchtr — Fri, 14 Mar 2014 20:51:34 GMT

I have some logs that list the bandwidth in either Mbps or Gbps. I want to make some reports that show everything as Gbps so I need to normailze the data so Mbps is converted to Gbps. I would like to take the Gbps and perform evals etc.

Any help would be appreciated.

Re: Data normalization for bandwidth from Mbps to Gbps

linu1988 — Fri, 14 Mar 2014 21:29:11 GMT

Howz the log look like? means how the field is populated? any sample value?

Re: Data normalization for bandwidth from Mbps to Gbps

sswansonchtr — Fri, 14 Mar 2014 21:38:44 GMT

Here is an example:

"6.55 Mbps/7.42 Kpps"
or
"6.55 Gbps/72.4 Kpps"

They are extracted in the same field. Just need to be converted to similar types of data.

Re: Data normalization for bandwidth from Mbps to Gbps

linu1988 — Fri, 14 Mar 2014 22:41:16 GMT

Hello,
Assuming you have your values are coming as mention in the field say "a" the search would go like this

source=x  |eval b=if(like(a,"%Gb%"),1,0)|eval c=split(a," ")|eval d=mvindex(c,0)|eval d1=mvindex(c,1)|eval d1=replace(d1,"M","G")|eval d2=mvindex(c,2)|eval d=d/1000|eval d=d." ".d1." ".d2|eval a=if(b==0,d,a)|table a

Thanks

Re: Data normalization for bandwidth from Mbps to Gbps

martin_mueller — Fri, 14 Mar 2014 22:45:44 GMT

You can make use of the built-in convert memk(field) command if your kilos are 2^10 rather than 10^3:

| stats count | eval bw = "6.55 Gbps,5.66 Mbps" | makemv delim="," bw | mvexpand bw | eval bw = replace(bw, " (\w)bps$", "\1") | convert memk(bw) | eval bw = tostring(round(bw/1048576, 2))+" Gbps"

That fiddles with the bandwidth field to make it read "6.55G" and "5.66M" instead of the spaced Gbps, converts to K using power-of-two, converts from K to G, adds back the fancy unit.

Re: Data normalization for bandwidth from Mbps to Gbps

sswansonchtr — Fri, 25 Jul 2014 16:51:37 GMT

The above solutions appear to work but I actually did it in the props.conf as a new field:

EVAL-bandwidth_mbps = case(substr(bandwidth,len(bandwidth)-3,4)="Gbps",tonumber(substr(bandwidth,1,len(bandwidth)-5))*1000,substr(bandwidth,len(bandwidth)-3,4)="Mbps",tonumber(substr(bandwidth,1,len(bandwidth)-5)))

EVAL-pps_kpps = case(substr(pps,len(pps)-3,4)="Kpps",tonumber(substr(pps,1,len(pps)-5)),substr(pps,len(pps)-2,3)="pps",tonumber(substr(pps,1,len(pps)-4)))

This was better for my application.