Splunk Dev

How to gather user bandwidth for specify url?

cmndata1
New Member

Hi all,

Thanks all for spending time to my case.

I would like to list out a table to show the user web browsing log.
For example, what url they will go when they are surfing splunk.com

Table would like to be like that.

Date | Time | User | hostname (this maybe splunk.com) | url | Total SentByte | Total Receive Byte (rcvdbyte)

Do you guys has any idea?

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cmndata1 ,
You might need to provide more details for us to help you better.
What's the source of data ? What kind of events do you have now? Do you have the specified fields in your events?

In general it would be

     index="your index" source="your firewall source" | stats sum(rcvdbyte) as rcvd,sum(sentbyte) as sent by url
     |eval bandwidth=rcvd + sent
Happy Splunking!
0 Karma

cmndata1
New Member

@renjith.nair
Thank you so much.
I would like to give you some fields that is useful.

  1. Date (e.g Mar 7)
  2. Time (e.g 14:00:00)
  3. User (e.g Tom_Chan)
  4. hostname (e.g www.google.com)
  5. url
  6. sentbyte (could it transform to MB?)
  7. rcvdbyte (could it transform to MB?)
  8. srcip(user source IP)

index would be fgt_utm
The firewall is sending log to splunk.
For ideal case, i would like to list out how many bandwidth did the user spend on each url.

Thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Probably you can start with below and lets know what changes you need. If you may added additional group by clause (Date,srcip etc)

index=fgt_utm "your other filters for sourcetype"
|eval bandwidthMb=((sentByte/1000000)+(rcvdbyte /1000000))
|stats sum(bandwidthMb) as BandwidthUsed by User,url,host
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...