Splunk Search

Data Model Query tstats

Explorer

Dear Experts,

Request you help to convert this below query into tstats query.

index=networkproxy category="Personal Network Storage and Backup" | eval Megabytes=(((bytesout/1024)/1024))| stats sum(Megabytes) as Megabytes by user destnthost |eval Megabytes=round(Megabytes,3)| sort -Megabytes| fields user destnthost Megabytes|head 10

Converting into tstats

(| tstats count from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup" ) (Web.user!="LDAP*") by Web.user ) help required to how to do this.

Thanks in advance.

Tags (3)
0 Karma
1 Solution

Champion

I don't have this Datamodel to test with, but the query you are looking for should be close to this.

| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes

View solution in original post

Champion

I don't have this Datamodel to test with, but the query you are looking for should be close to this.

| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes

View solution in original post