Bandwidth from IIS Logs

[chca]

I'm using a a timechart (I presume that is the correct method) to display the bandwidth sent by IIS per minute for video files. So far this is what I have:

(flv OR mp4 OR mov OR wmv) AND /hosted | timechart span=1m avg(cs_bytes)

This returns a one-minute table, but the averages for the bytes are blank. Any ideas?

UPDATE
I'm thinking that I also need to incorporate the IIS field "time_taken", to know how long it took for this event to complete. What I need to setup bucket increments, then determine how many buckets any given event takes to complete. Then divide the bytes sent by the number of buckets, and use that to sum up the amount of bytes per bucket. Easy. 😜 Ack.

[lguinn2]

Are you sure that the field name is cs_bytes?

Do you get events if you just search for

(flv OR mp4 OR mov OR wmv) AND /hosted

[chca]

I just realized I had a small issue with the source, so now I'm getting the results as expected. I don't think it's quite accurate though; as-written, it presumes that all data is sent within the smallest bucket. As noted above, I need to take into account for time_taken.

[chca]

Yes, that field is listed in the "Other Interesting Fields." And yes, I get results as expected without the timechart; it shows me a total number of hits per bucket.