All Apps and Add-ons

How to monitor proxy uploaded data split by users, greater than say 1GB Splunk for Blue Coat ProxySG?

Explorer

Monitoring proxy uploaded data split by users, greater than say 1GB in the last 24hrs and then Alert.

Not sure how to do this.

index="proxy_logs" time="*"  filter_results=OBSERVED protocol="*" url="*"  upload="*" user="*" | 
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @SGun,

Try this,

index="proxy_logs"  <rest of your search> | stats sum(your data size  field/1073741824 ) as total_gb by user | where total_gb > "your threshold value"

Please provide your field name of data size and also unit if the above does not work

View solution in original post

0 Karma

Explorer

| stats sum(upload) as total by user | where total > 10000000

Works great.

So if I wanted to add this output to a table, with other information such as date, time, user, url, upload?

0 Karma

SplunkTrust
SplunkTrust

If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause

0 Karma

SplunkTrust
SplunkTrust

Hi @SGun,

Try this,

index="proxy_logs"  <rest of your search> | stats sum(your data size  field/1073741824 ) as total_gb by user | where total_gb > "your threshold value"

Please provide your field name of data size and also unit if the above does not work

View solution in original post

0 Karma

Explorer

| stats sum(upload) as total by userID | where total > 10000000

Works great.

So if I wanted to add this output to a table, with other information such as date, time, user, url, upload?

0 Karma

SplunkTrust
SplunkTrust

If you would like to split by other fields , then you can add them to the by clause e.g. | stats sum(upload) as total by user,upload . However its not an aggregation over user but all other fields in by clause

0 Karma

Explorer

index="proxy_logs" filter_results=OBSERVED | stats sum(upload) as total by date,time,userID,url | where total > 10000000

Thanks again for your help.

0 Karma

Explorer

index="proxy_logs" filter_results=OBSERVED | eval MB=upload/(1024*1024) | stats sum(upload) as total by date,userID,url,MB upload | where total > 10000000

does the conversion to MB - still need to aggregate the user upload

0 Karma

Explorer

I also need to figure out how to aggregate the data or just show the highest upload by the user

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!