How to monitor proxy uploaded data split by users, greater than say 1GB Splunk for Blue Coat ProxySG?

[SGun]

Monitoring proxy uploaded data split by users, greater than say 1GB in the last 24hrs and then Alert.

Not sure how to do this.

index="proxy_logs" time="*"  filter_results=OBSERVED protocol="*" url="*"  upload="*" user="*" | 

[SGun]

| stats sum(upload) as total by user | where total > 10000000

Works great.

So if I wanted to add this output to a table, with other information such as date, time, user, url, upload?

[renjith_nair]

If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause

[renjith_nair · Accepted solution]

Hi @SGun,

Try this,

index="proxy_logs"  <rest of your search> | stats sum(your data size  field/1073741824 ) as total_gb by user | where total_gb > "your threshold value"

Please provide your field name of data size and also unit if the above does not work

[SGun]

| stats sum(upload) as total by userID | where total > 10000000

Works great.

So if I wanted to add this output to a table, with other information such as date, time, user, url, upload?

[renjith_nair]

If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause

[SGun]

index="proxy_logs" filter_results=OBSERVED | stats sum(upload) as total by date,time,userID,url | where total > 10000000

Thanks again for your help.

[SGun]

index="proxy_logs" filter_results=OBSERVED | eval MB=upload/(1024*1024) | stats sum(upload) as total by date,userID,url,MB upload | where total > 10000000

does the conversion to MB - still need to aggregate the user upload

[SGun]

I also need to figure out how to aggregate the data or just show the highest upload by the user