I'm using a a timechart (I presume that is the correct method) to display the bandwidth sent by IIS per minute for video files. So far this is what I have:
(flv OR mp4 OR mov OR wmv) AND /hosted | timechart span=1m avg(cs_bytes)
This returns a one-minute table, but the averages for the bytes are blank. Any ideas?
I'm thinking that I also need to incorporate the IIS field "time_taken", to know how long it took for this event to complete. What I need to setup bucket increments, then determine how many buckets any given event takes to complete. Then divide the bytes sent by the number of buckets, and use that to sum up the amount of bytes per bucket. Easy. 😜 Ack.
I just realized I had a small issue with the source, so now I'm getting the results as expected. I don't think it's quite accurate though; as-written, it presumes that all data is sent within the smallest bucket. As noted above, I need to take into account for time_taken.