Installation

Convert search to display the results in GB instead of bytes?

sunnyparmar
Communicator

Hi,

Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage

Thanks in Advance

Labels (1)
Tags (4)
0 Karma
1 Solution

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

View solution in original post

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

ddrillic
Ultra Champion

It can be nice to define a new field for this purpose via -
Fields >> Calculated fields >> Add new

0 Karma

somesoni2
Revered Legend

It will depend upon the usage. LIke here, in-search calculation will be faster as it's done after the aggregation command (chart), and would be in-efficient (relatively) if it was a calculated field.

0 Karma

somesoni2
Revered Legend

One performance improvement suggestion on @javiergn's answer, to do the lookup after the chart command.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...