Getting Data In

report on counters

mlevenson
Explorer

I am trying to create a report of network bytes from the Universal Forwarder, WMI is not an option for me. Here is an excerpt of the fields

5/11/12
8:30:42.863 AM

05/11/2012 08:30:42.863
collection="Network Interface"
object="Network Interface"
counter="Bytes Sent/sec"
instance="HP NC7782 Gigabit Server Adapter _3"
Value=2578.7604252584738

host=STBACKUP06   Options|  
sourcetype=Perfmon:Network Interface   Options|  
source=Perfmon:Network Interface   Options

3 » 5/11/12
8:30:42.863 AM

05/11/2012 08:30:42.863
collection="Network Interface"
object="Network Interface"
counter="Bytes Received/sec"
instance=isatap.redmond.corp.microsoft.com
Value=1523.9033187413756

host=STBACKUP06   Options|  
sourcetype=Perfmon:Network Interface   Options|  
source=Perfmon:Network Interface   Options

The counter's are different but they both use the word Value for data and I tried to use a search to join these and it failed.

source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Sent/sec"|stats avg(Value) AS Bytes_in by host|join host[search source="Perfmon:Network Interface" host=stbackup06 counter="Bytes Recieved/sec"|stats avg(Value) AS Bytes_Rec by host]|timechart avg(Bytes_in) avg(Bytes_Rec)

I ended up with no data. What am I missing?

Tags (1)
0 Karma

cphair
Builder

For network bytes, it can make sense to show the two values together on a graph. Try a variation on the below search, make it a stacked area chart, and see if you like the results. (Subsearches are often pretty slow, and I try to avoid them.)


host=stbackup06 counter="Bytes Sent/sec" OR counter="Bytes Received/sec" | timechart avg(Value) as Avg by counter

Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...