Reporting

How to generate report of Bandwidth usage per user and URL

newcomer
Engager

Hi,

 

I'm trying to generate a report with the following information

-Total Bandwidth for each user

-List of top 3 (Bandwidth usage) URLs for each user

-Bandwidth for each URL

For example

Example.JPG

 

Thank you!

Labels (2)
0 Karma
1 Solution

marysan
Communicator

I can't understand URL Category field role ! so I did it without considering URL Category
In addition I converted bytes to MB AND GB with division to 3145728 and 1073741824
this must work for you :

index=Myindex  url=* user="*" bytes=*

|eventstats sum(bytes) as TotalBandwidth_user by user
| eval TotalBandwidth_user=(TotalBandwidth_user/1073741824)
|eventstats sum(bytes) as TotalBandwidth_url by url
| eval TotalBandwidth_url=(TotalBandwidth_url/3145728)
| table user,TotalBandwidth_url,TotalBandwidth_user,url
| dedup user,TotalBandwidth_url,TotalBandwidth_user,url
|sort -TotalBandwidth_url
| stats list(url) as url , list(TotalBandwidth_url) as TotalBandwidth_url , values(TotalBandwidth_user) as TotalBandwidth_user(GB) by user
| eval top_TotalBandwidth_url(MB)=mvindex(TotalBandwidth_url,0,2)
| eval top_url=mvindex(url,0,2)
| table user,TotalBandwidth_user(GB),top_url,top_TotalBandwidth_url(MB)

View solution in original post

marysan
Communicator

I can't understand URL Category field role ! so I did it without considering URL Category
In addition I converted bytes to MB AND GB with division to 3145728 and 1073741824
this must work for you :

index=Myindex  url=* user="*" bytes=*

|eventstats sum(bytes) as TotalBandwidth_user by user
| eval TotalBandwidth_user=(TotalBandwidth_user/1073741824)
|eventstats sum(bytes) as TotalBandwidth_url by url
| eval TotalBandwidth_url=(TotalBandwidth_url/3145728)
| table user,TotalBandwidth_url,TotalBandwidth_user,url
| dedup user,TotalBandwidth_url,TotalBandwidth_user,url
|sort -TotalBandwidth_url
| stats list(url) as url , list(TotalBandwidth_url) as TotalBandwidth_url , values(TotalBandwidth_user) as TotalBandwidth_user(GB) by user
| eval top_TotalBandwidth_url(MB)=mvindex(TotalBandwidth_url,0,2)
| eval top_url=mvindex(url,0,2)
| table user,TotalBandwidth_user(GB),top_url,top_TotalBandwidth_url(MB)

newcomer
Engager

Thank you so much, Marysan!

That's exactly what I wanted.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...