Splunk Enterprise Security

How can I compare the bandwidth usage of a specific category to the bandwidth usage of all categories combined?

digital_alchemy
Path Finder

For some reason I'm hitting a wall on the logic of this search. I'm working with Palo Alto logs and the fields i'm interested in are the bytes and category fields.

Essentially I would need to sum the total bytes for all categories over a 30 minute period and then sum bytes for the streaming category for the same period, then display a line chart showing the comparison for the bandwidth used for the streaming category to the bandwidth used by all categories combined by minute.

0 Karma

FrankVl
Ultra Champion

Try the following: create a timechart, then addtotals, then remove all the unwanted category columns:

...your base search...
| timechart sum(bytes) by category
| addtotals
| fields _time,streaming,Total
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @digital_alchemy,

Try this,

your search |eventstats sum(bytes) as total|search category="streaming category"|timechart sum(bytes) as streaming_bytes,first(total) as total
0 Karma

FrankVl
Ultra Champion

He mentions he is looking for a linechart over time. So your eventstats should be by _time. Also: your last stats command will drop the totals.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

thanks @FrankVI, forgot to add the total to the result

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!