Splunk Search

Bandwidth from IIS Logs

chca
Path Finder

I'm using a a timechart (I presume that is the correct method) to display the bandwidth sent by IIS per minute for video files. So far this is what I have:

(flv OR mp4 OR mov OR wmv) AND /hosted | timechart span=1m avg(cs_bytes)

This returns a one-minute table, but the averages for the bytes are blank. Any ideas?

UPDATE
I'm thinking that I also need to incorporate the IIS field "time_taken", to know how long it took for this event to complete. What I need to setup bucket increments, then determine how many buckets any given event takes to complete. Then divide the bytes sent by the number of buckets, and use that to sum up the amount of bytes per bucket. Easy. 😜 Ack.

Tags (3)
0 Karma

lguinn2
Legend

Are you sure that the field name is cs_bytes?

Do you get events if you just search for

(flv OR mp4 OR mov OR wmv) AND /hosted
0 Karma

chca
Path Finder

I just realized I had a small issue with the source, so now I'm getting the results as expected. I don't think it's quite accurate though; as-written, it presumes that all data is sent within the smallest bucket. As noted above, I need to take into account for time_taken.

0 Karma

chca
Path Finder

Yes, that field is listed in the "Other Interesting Fields." And yes, I get results as expected without the timechart; it shows me a total number of hits per bucket.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...