Splunk Search

Data Model Query tstats

sumitkathpal
Explorer

Dear Experts,

Request you help to convert this below query into tstats query.

index=network_proxy category="Personal Network Storage and Backup" | eval Megabytes=(((bytes_out/1024)/1024))| stats sum(Megabytes) as Megabytes by user dest_nt_host |eval Megabytes=round(Megabytes,3)| sort -Megabytes| fields user dest_nt_host Megabytes|head 10

Converting into tstats

(| tstats count from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup" ) (Web.user!="LDAP*") by Web.user ) help required to how to do this.

Thanks in advance.

Tags (3)
0 Karma
1 Solution

rjthibod
Champion

I don't have this Datamodel to test with, but the query you are looking for should be close to this.

| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes

View solution in original post

rjthibod
Champion

I don't have this Datamodel to test with, but the query you are looking for should be close to this.

| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...