Splunk Search

Covert KB to MB in a chart count search.

pdantuuri0411
Explorer

I have a chart count of Index using License usage using the below search. The search works fine but how to convert the usage from KB to MB.

index=_internal source=license_usage.log type="usage" idx=* earliest_time=-7d@d | convert timeformat="%F" ctime(_time)
| chart count over idx by _time | eval Time=strftime(_time,"%m-%d")

Thank you

0 Karma
1 Solution

tauliang
Communicator

You can add an extra line in the end to flip the axes

    | transpose

View solution in original post

tauliang
Communicator

You can add an extra line in the end to flip the axes

    | transpose

pdantuuri0411
Explorer

Thank you. This helped few a few minor changes.

0 Karma

tauliang
Communicator

Try this: divide "b" by 1024*1024=104857, you will get the usage in MB:

index=_internal source=*.log source="license_usage.log"
type="usage" idx=* earliest_time=-7d@d
|eval UsageInMB = round(b/1048576,2) 
| convert timeformat="%F" ctime(_time)
| chart sum(UsageInMB) over idx by _time 
| eval Time=strftime(_time,"%m-%d")

pdantuuri0411
Explorer

Thank you @tauliang for the reply. I tried what you just posted by it did not convert from KB to MB. below is the result I got.

i_apache_coc 4771 4608 4650 4734 4814 5102 3454
i_apache_revproxy_24 5227 4989 4156 4090 4879 4729 4845

0 Karma

tauliang
Communicator

Interesting. If somehow it doesn't work for you, I suggest downloading this app

https://splunkbase.splunk.com/app/2949/

and see if it shows all the meta data correctly.

0 Karma

pdantuuri0411
Explorer

Unfortunately I dont have permissions to download apps for our splunk environment.

Strange thing is, when I tried the same chart using time chart[1], I am able to retrieve data in MB. The issue was I wanted to swap X axis and Y axis, so I modified the search to use chart count. Any other suggestions?

[1]
index=_internal source=license_usage.log type="Usage" idx=* earliest_time=@w
| timechart span=1d limit=0 eval(round(sum(b)/1024/1024,3)) as MB by idx | sort -_time

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...