Installation

Convert search to display the results in GB instead of bytes?

sunnyparmar
Communicator

Hi,

Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage

Thanks in Advance

Labels (1)
Tags (4)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

View solution in original post

ddrillic
Ultra Champion

It can be nice to define a new field for this purpose via -
Fields >> Calculated fields >> Add new

0 Karma

somesoni2
Revered Legend

It will depend upon the usage. LIke here, in-search calculation will be faster as it's done after the aggregation command (chart), and would be in-efficient (relatively) if it was a calculated field.

0 Karma

somesoni2
Revered Legend

One performance improvement suggestion on @javiergn's answer, to do the lookup after the chart command.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!