Splunk Search

Converting units in my classification breaks my alert?

klaudiac
Path Finder

Hi, 

I had a good base search for a calculation and alerting when an upload/download happens, but now I tried to tidy it up and convert bytes to KB and show a percentage as a "10%" instead of just "10", but somewhere along the way my search breaks... 
When i try to show bytes as KB using this:

| eval total_KB_bytes=round(total_bytes/1024,0)."KB"
| eval KB_bytes_in=round(bytes_in/1024,0)."KB"
| eval KB_bytes_out=round(bytes_out/1024,0)."KB" 

my Classification and  Alert break. 


Any help would be greatly appreciated! 


The The original search is:

index=zscaler http_method IN ("POST", "PUT")

| rename bytes as "total_bytes"
| table _time index user src_user_email dest app appclass category http_method filetype total_bytes bytes_in bytes_out

| eval user_bytes_perc_download = round((bytes_in/total_bytes)*100,2)
| eval user_bytes_perc_upload = round((bytes_out/total_bytes)*100,2)
| eval Classification=case(user_bytes_perc_download > 70,"download", user_bytes_perc_upload > 70,"upload", user_bytes_perc_download <70 AND user_bytes_perc_upload <70, "none")

| eval Alert=if((Classification="download" OR Classification="upload") AND total_bytes > 20000, "YES", "NO")
Labels (1)
0 Karma
1 Solution

rnowitzki
Builder

Hi  @klaudiac,

Try fieldformat. It does change the way a value is displayed, but does not change the underlaying value/type of data.

|  eval kb=bytes/1024
| fieldformat kb=round(kb,2)."kb"

 
Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

tfujita_splunk
Splunk Employee
Splunk Employee

This could be also solution for you.

https://community.splunk.com/t5/Splunk-Search/FileSize-to-human-readable/m-p/629602/highlight/true#M...

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach bytes [eval <<FIELD>>=val]
| table digit val bytes
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))

 

If you can install app or ask admin on your to install app,

installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach bytes [eval <<FIELD>>=val]
| table digit val bytes
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

 

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595


Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio...

0 Karma

rnowitzki
Builder

Hi  @klaudiac,

Try fieldformat. It does change the way a value is displayed, but does not change the underlaying value/type of data.

|  eval kb=bytes/1024
| fieldformat kb=round(kb,2)."kb"

 
Hope it helps.
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

klaudiac
Path Finder

Hi Ralph, 

The | fieldformat makes it look so much neater, thanks very much! 🙂 

rnowitzki
Builder

Hi Klaudia,

There is nothing wrong with your SPL 🙂  And you found a workaround (Set the Alert trigger before adding the "KB"), so this is just cosmetic:

You could just change the last 5 evals to fieldformat. 
That way, the values are still numbers, but display for us silly humans with "KB" (or %)  😛

| eval total_KB_bytes=total_KB_bytes."KB"
change to => | fieldformat total_KB_bytes=total_KB_bytes."KB"

| eval KB_bytes_in=KB_bytes_in."KB"
change to => | fieldformat KB_bytes_in=KB_bytes_in."KB"


and so forth with all 5 evals.

Now you can still calculate/compare/whatever with the values, regardless of the "KB" added.

Cheers
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...