Installation

Convert search to display the results in GB instead of bytes?

sunnyparmar
Communicator

Hi,

Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage

Thanks in Advance

Labels (1)
Tags (4)
0 Karma
1 Solution

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

View solution in original post

javiergn
Super Champion

Try this:

index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | eval total_usage = round((total_usage/1024/1024/1024), 2) |  sort -total_usage

ddrillic
Ultra Champion

It can be nice to define a new field for this purpose via -
Fields >> Calculated fields >> Add new

0 Karma

somesoni2
Revered Legend

It will depend upon the usage. LIke here, in-search calculation will be faster as it's done after the aggregation command (chart), and would be in-efficient (relatively) if it was a calculated field.

0 Karma

somesoni2
Revered Legend

One performance improvement suggestion on @javiergn's answer, to do the lookup after the chart command.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...