Splunk Search

Convert bytes to GB

Eyb
New Member

Splunk noob here. I've been visting this site for awhile now so i decided to create my own account so I can learn more about the product.

I'm trying to create a bandwidth utilization for my web logs and I'm a bit confused on what search string should I be using to get accurate date. I have tried the following and got different ressults.

example A :
base search | eval s_kilobytes=(sentbyte/1024) | eval s_megabytes=s_kilobytes/1024 | eval s_gigabytes=s_megabytes/1024 | eval r_kilobytes=(rcvdbyte/1024) | eval r_megabytes=r_kilobytes/1024 | eval r_gigabytes=r_megabytes/1024| timechart sum(r_gigabytes) as "RECEIVED" sum(s_gigabytes)

example B:
base search | | stats sum(eval(((sentbyte*8)/(1024*1024*1024*1024) + (rcvdbyte*8)/(1024*1024*1024*1024))))

Which one is the more accurate one and what does the value 8 on second example means?

Abe

Tags (3)
0 Karma
1 Solution

hortonew
Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"

View solution in original post

Eyb
New Member

Hortonew,

Sorry for the delay, caught up with lots of stuff. THANK YOU! Appreciate the help.

Abe

0 Karma

hortonew
Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...