DC of users per 5 mins with Kbps calculation

[a277437]

Hi all,

I have been using Splunk for about 2 days, so am VERY new.  I'm trying to get a utilization number for endpoint analytics.

What I would like is a query that can tell me the Kbps (formula below) per User each 5 minutes for whatever timespan dropdown I pick.  I have tried numerous ways to do it and have had no luck.  Is there a way I can get a table maybe?  that will show me the count (or maybe dc) of users each 5 minutes and the avg Kbps per user?

The query below gives me a timechart by src_IP, but it doesn't look right to me, so I'd like a way to verify (hence the table). 

index="myIndex"  source="tcp:xxxx" | eval Kbps=(((cs_bytes*8)/1000)/300) | timechart span=5m avg(Kbps) by src_ip

I've tried this to get the table, but it doesn't work - it gives me zero matches

index="myIndex"  source="tcp:xxxx"

| bin _time span=5m

| dedup src_ip as SrcIP

| streamstats sum(cs_bytes) as Bytes by SrcIP

| eval Kbps=(((Bytes*8)/1000)/300)

| table SrcIP Bytes Kbps

Any guidance is much appreciated!

[a277437]

No, that is not what I really wanted and you gave me EXACTLY what I did want and I can't think you enough!!  You are a legend 🙂

[a277437]

PS - I don't need to see the src_ip like I put in the table (that may be the issue)

| table _time, src_ip TotalKbps UtilPerUser TotalBytes

[a277437]

Thank you!!

So to double check I'm trying to get the total number of distinct source Ips, the total Kbps, and then divide the Total Kbps by the Count of src_ips (users).  I tried this, but it doesn't work

index="myIndex"  source="tcp:xxxx"

 | bin _time span=5m

 | dedup src_ip _time

   **some intervals have more than one source IP, so I either want to get rid of it, or somehow add those bytes up as one number - but, if I have to, I'm okay with just using one occurrence in the 5 min. interval

 | stats count(src_ip) as NumUser

** then I'm trying to get a total number of users for the 5 minutes

 | eval TotalBytes = sum(cs_bytes)

** summarize the total number of bytes for the period

 | eval TotalKbps = (((TotalBytes*8)/1000)/300)

 | eval UtilPerUser = TotalKbps/NumUser

 | table _time, src_ip TotalKbps UtilPerUser TotalBytes

It's not working - I think I know why, but can't figure out another way...  any suggestions would be most welcome!!

Thank you again!!

[ITWhisperer · Accepted solution]

index="myIndex"  source="tcp:xxxx"
| bin _time span=5m
| stats sum(cs_bytes) as Bytes dc(src_ip) as users by _time 
| eval Kbps=(((Bytes*8)/1000)/300)
| eval UtilPerUser=Kbps/users
| table _time Bytes Kbps UtilPerUser

dedup just keeps the first event for each combination of the fields so by removing the other events your total bytes would be incomplete. Is that what you really wanted?

[ITWhisperer]

index="myIndex"  source="tcp:xxxx"
| bin _time span=5m
| stats sum(cs_bytes) as Bytes by _time src_ip
| eval Kbps=(((Bytes*8)/1000)/300)
| table src_ip Bytes Kbps