Reporting

How to generate report of Bandwidth usage per user and URL

newcomer
Engager

Hi,

 

I'm trying to generate a report with the following information

-Total Bandwidth for each user

-List of top 3 (Bandwidth usage) URLs for each user

-Bandwidth for each URL

For example

Example.JPG

 

Thank you!

Labels (2)
0 Karma
1 Solution

marysan
Communicator

I can't understand URL Category field role ! so I did it without considering URL Category
In addition I converted bytes to MB AND GB with division to 3145728 and 1073741824
this must work for you :

index=Myindex  url=* user="*" bytes=*

|eventstats sum(bytes) as TotalBandwidth_user by user
| eval TotalBandwidth_user=(TotalBandwidth_user/1073741824)
|eventstats sum(bytes) as TotalBandwidth_url by url
| eval TotalBandwidth_url=(TotalBandwidth_url/3145728)
| table user,TotalBandwidth_url,TotalBandwidth_user,url
| dedup user,TotalBandwidth_url,TotalBandwidth_user,url
|sort -TotalBandwidth_url
| stats list(url) as url , list(TotalBandwidth_url) as TotalBandwidth_url , values(TotalBandwidth_user) as TotalBandwidth_user(GB) by user
| eval top_TotalBandwidth_url(MB)=mvindex(TotalBandwidth_url,0,2)
| eval top_url=mvindex(url,0,2)
| table user,TotalBandwidth_user(GB),top_url,top_TotalBandwidth_url(MB)

View solution in original post

marysan
Communicator

I can't understand URL Category field role ! so I did it without considering URL Category
In addition I converted bytes to MB AND GB with division to 3145728 and 1073741824
this must work for you :

index=Myindex  url=* user="*" bytes=*

|eventstats sum(bytes) as TotalBandwidth_user by user
| eval TotalBandwidth_user=(TotalBandwidth_user/1073741824)
|eventstats sum(bytes) as TotalBandwidth_url by url
| eval TotalBandwidth_url=(TotalBandwidth_url/3145728)
| table user,TotalBandwidth_url,TotalBandwidth_user,url
| dedup user,TotalBandwidth_url,TotalBandwidth_user,url
|sort -TotalBandwidth_url
| stats list(url) as url , list(TotalBandwidth_url) as TotalBandwidth_url , values(TotalBandwidth_user) as TotalBandwidth_user(GB) by user
| eval top_TotalBandwidth_url(MB)=mvindex(TotalBandwidth_url,0,2)
| eval top_url=mvindex(url,0,2)
| table user,TotalBandwidth_user(GB),top_url,top_TotalBandwidth_url(MB)

newcomer
Engager

Thank you so much, Marysan!

That's exactly what I wanted.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...