how to calculate the percentage bandwidth utilization for both incoming and outgoing traffics from a switch/router?

[bidahor13]

Trying to calculate the percentage bandwidth utilization on each link -How can I achieve that?

index=snmp dst_device="mdf1" src_device="mdf2" |delta _time as period | eval transferedBitsIn=snmpIfInOctets*8/period | eval transferedBitsOut=snmpIfOutOctets*8/period | timechart span=5s sum(transferedBitsIn) as Input sum(transferedBitsOut) as output by source

[Richfez]

Given your search, since that's all I can see, I can make a few remarks on how to accomplish this.

One method is to do some math directly in the timechart command. In this case, something like this might work:

...| timechart span=5s sum(transferedBitsIn) as Input, sum(transferedBitsOut) as output, eval(sum(transferedBitsIn)/100000000) as Percentage_in by source

Or, create a new field with the value, then use that.

...| eval Max_Bandwidth=100000000 | timechart span=5s sum(transferedBitsIn) as Input, sum(transferedBitsOut) as output, eval(sum(transferedBitsIn)/sum(Max_Bandwidth)) as Percentage_in by source

In either case, you'll have to provide your own values, and probably do a little cleanup on making it show up right. My GUESS is that you'll actually need eval(sum(transferedBitsIn)/avg(Max_Bandwidth)) instead of sum(Max_Bandwidth), but with the problems seeing your raw data (or even a sample), I'm not sure.

One final caveat, I probably did my division backwards. 🙂

[bidahor13]

lol..thanks rich7177, I will try it out.

[Richfez]

You might also have access to something like the snmp OID for ifSpeed (I believe 1.3.6.1.2.1.2.2.1.5, but could be slightly elsewhere). If you have that, and it reflects the connection speed, you could use that instead of creating your own "Max_Bandwidth". It's worth a look.

[woodcock]

Your link "works" but shows a useless image.

How much is this related to this other question?

http://answers.splunk.com/answers/289809/how-to-calculate-bandwidth-utilization-on-an-snmp.html

[bidahor13]

not related!

[bidahor13]

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif

[sajbutler]

Hi bidahor13

A couple of observations:
1. It looks like the transferedBitsIn and transferedBitsOut fields are calculating a per second value. If this the case, then using average would be more appropriate than sum in your timechart
2. If you want to calculate a percentage utilisation, then you need to divide bandwidth used by bandwidth total

It would be a good to get a sample of data so we can give more specific pointers

[sajbutler]

Getting a HTTP Status 403 error when clicking on the link

[bidahor13]

See the snap shot below:

[sajbutler]

Sorry, I can't see the link below. Its a broken link for me

[bidahor13]

hi sajbutler - I just sent you the link .Let me know if it helps thanks.

[bidahor13]

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif

[jtrucks]

Can you show examples of the source event data?

[bidahor13]

index=snmp | eval link=if(src_device previousIn , currentIn, previousIn) | eval current1_Out = if( currentOut > previousOut , currentOut, previousOut) | eval current2_In = (maxValue + current1_In)/period | eval current2_Out = (maxValue + current1_Out)/period | eval transferredBitsIn_kByte=round((current2_In)/1000 ,1) | eval transferredBitsOut_kByte=round((current2_Out)/1000,1) | timechart span=48s avg(transferredBitsOut_kByte) AS Tx_OUT avg(transferredBitsIn_kByte) AS Tx_IN by link | eval Tx_OUT = round(Tx_OUT,1) | eval Tx_IN = round(Tx_IN , 1)

[bidahor13]

Made some changes on my last SPL - does the data search look accurate to generate the bandwidth data and bits transferred by each link? If sit does- how do i calculate the percentage utilization for each link?

[bidahor13]

http://answers.splunk.com/storage/temp/56172-bandwidth-new.gif