Splunk Enterprise

Bandwidth utilization for all the interface from one event

gowri
New Member

This is my sample:

IF-MIB::ifInOctets."1" = "0" IF-MIB::ifOutOctets."1" = "0" IF-MIB::ifSpeed."1" = "1544000" IF-MIB::ifInOctets."2" = "1187372505" IF-MIB::ifOutOctets."2" = "2986764562" IF-MIB::ifSpeed."2" = "100000000" IF-MIB::ifInOctets."3" = "1943133249" IF-MIB::ifOutOctets."3" = "1502732268" IF-MIB::ifSpeed."3" = "100000000" IF-MIB::ifInOctets."4" = "0" IF-MIB::ifOutOctets."4" = "0" IF-MIB::ifSpeed."4" = "56000" IF-MIB::ifInOctets."5" = "0" IF-MIB::ifOutOctets."5" = "0" IF-MIB::ifSpeed."5" = "4294967295" IF-MIB::ifInOctets."6" = "0" IF-MIB::ifOutOctets."6" = "5703" IF-MIB::ifSpeed."6" = "4294967295" IF-MIB::ifInOctets."7" = "0" IF-MIB::ifOutOctets."7" = "5703" IF-MIB::ifSpeed."7" = "4294967295" IF-MIB::ifInOctets."8" = "0" IF-MIB::ifOutOctets."8" = "5703" IF-MIB::ifSpeed."8" = "4294967295" IF-MIB::ifInUcastPkts."1" = "0" IF-MIB::ifOu

I am trying to caluculate the bandwidth utilization of all the interface. But i could get it for the interface 1 .

index="snmp-stats" host="172.16.1.1" |delta inbound_traffic as DIFFIN p=1 | delta  outbound_traffic as DIFFOUT  p=1 | eval BandIN=DIFFIN*800/100000000 | eval BandOUT=DIFFOUT*800/100000000 | table  _time BandIN BandOUT   | sort -_time | rename _time as Time | convert ctime(Time) | head 500

I am getting a table like this

BandIN        BandOUT     Interface 
xxxxxxx       yyyyyyyy    1
zzzzzz        bnbbbbb     1
hhhhh         nnnnnnn     1

I want something like this

BandIN        BandOUT     Interface 
xxxxxxx       yyyyyyyy    1
zzzzzz        bnbbbbb     2
hhhhh         nnnnnnn     3
2323          ggggg       4

Can anyone please help me solve this issue. Thanks!

Tags (1)
0 Karma

woodcock
Esteemed Legend

Assuming that your sample data is NOT all 1 event, and the traffic fields are accumulators, try this:

index="snmp-stats" host="172.16.1.1" | stats earliest(inbound_traffic) AS earliestIn latest(inbound_traffic) AS latestIn earliest(outbound_traffic) AS earliestOut latest(outbound_traffic) AS latestOut BY host Interface| eval BandIN=(latestIn - earliestIn)*8/(1024*1024) | eval BandOUT=(latestOut - earliestOut)*8/(1024*1024) | table host Interface BandIN BandOUT
0 Karma

gowri
New Member

Hi , Thanks for the reply. .My event is all one event.Will this work for one event.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...