Splunk Search

Convert bytes to GB

Eyb
New Member

Splunk noob here. I've been visting this site for awhile now so i decided to create my own account so I can learn more about the product.

I'm trying to create a bandwidth utilization for my web logs and I'm a bit confused on what search string should I be using to get accurate date. I have tried the following and got different ressults.

example A :
base search | eval s_kilobytes=(sentbyte/1024) | eval s_megabytes=s_kilobytes/1024 | eval s_gigabytes=s_megabytes/1024 | eval r_kilobytes=(rcvdbyte/1024) | eval r_megabytes=r_kilobytes/1024 | eval r_gigabytes=r_megabytes/1024| timechart sum(r_gigabytes) as "RECEIVED" sum(s_gigabytes)

example B:
base search | | stats sum(eval(((sentbyte*8)/(1024*1024*1024*1024) + (rcvdbyte*8)/(1024*1024*1024*1024))))

Which one is the more accurate one and what does the value 8 on second example means?

Abe

Tags (3)
0 Karma
1 Solution

hortonew
Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"

View solution in original post

Eyb
New Member

Hortonew,

Sorry for the delay, caught up with lots of stuff. THANK YOU! Appreciate the help.

Abe

0 Karma

hortonew
Builder

In your second example, you shouldn't be multiplying a byte by 8. You're thinking of 8 bits in a byte.

When you do your division, you can just do:

| eval s_GB=sentbyte/1024/1024/1024 | eval r_GB=rcvdbyte/1024/1024/1024 | timechart sum(r_GB) as "RECEIVED", sum(s_GB) as "SENT"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...