I'm triyng to create a graph in pivot that show the number of bytes over some other field, like IP. So the graph will show the number of bytes each IP downloaded.
But the number of bytes are too high, I'd like to show in Gb, ou Mb, instead of bytes.
The field auto-extracted from the datamodel is bytes. I've tried to create an eval field that contains Bytes/1073741824 to transform to Gb but the graph does not show anything.
Is there a way to splunk automatcally transform big numbers using the units ? Or how could I do that ?
Here are the steps you should follow:
bytesas an auto-extracted attribute to the data model object you're using for your Pivot. You need this in your object if you want to reference the
bytesattribute in the eval expression attribute (next step).
bytes/1073741824. Then give it a Field Name and Display Name of
Gb. (Note: Splunk is case-sensitive when it comes to field names, so if your field is extracted as "bytes," don't use "Bytes" in the eval expression.)
Gbwhere you were using
The object UI should do this automatically, but just in case: Make sure that the
Gb eval expression attribute is listed below the
bytes auto-extracted attribute. The eval expression attribute cannot reference attributes that are listed after it.
You can also add these attributes to a parent of the object you're using in Pivot; the object you're using in Pivot will inherit them.
I tested this on my end before writing up that procedure and it worked for me...I thought perhaps the problem was that you didn't have the bytes auto-extracted attribute in the object.
Ah, one more thing...it's case sensitive. So if your field is being extracted as "bytes" don't enter "Bytes/1073741824" into the Eval Expression field.