Splunk Search

## Convert bytes to GB

New Member

Splunk noob here. I've been visting this site for awhile now so i decided to create my own account so I can learn more about the product.

I'm trying to create a bandwidth utilization for my web logs and I'm a bit confused on what search string should I be using to get accurate date. I have tried the following and got different ressults.

example A :
base search | eval s_kilobytes=(sentbyte/1024) | eval s_megabytes=s_kilobytes/1024 | eval s_gigabytes=s_megabytes/1024 | eval r_kilobytes=(rcvdbyte/1024) | eval r_megabytes=r_kilobytes/1024 | eval r_gigabytes=r_megabytes/1024| timechart sum(r_gigabytes) as "RECEIVED" sum(s_gigabytes)

example B:
base search | | stats sum(eval(((sentbyte*8)/(1024*1024*1024*1024) + (rcvdbyte*8)/(1024*1024*1024*1024))))

Which one is the more accurate one and what does the value 8 on second example means?

Abe

Tags (3)
1 Solution
Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

``````| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"
``````
New Member

Hortonew,

Sorry for the delay, caught up with lots of stuff. THANK YOU! Appreciate the help.

Abe

Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

``````| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"
``````
Get Updates on the Splunk Community!

#### Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

#### Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

#### .conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...