Splunk Search

Data normalization for bandwidth from Mbps to Gbps

sswansonchtr
Path Finder

I have some logs that list the bandwidth in either Mbps or Gbps. I want to make some reports that show everything as Gbps so I need to normailze the data so Mbps is converted to Gbps. I would like to take the Gbps and perform evals etc.

Any help would be appreciated.

Tags (1)
0 Karma
1 Solution

sswansonchtr
Path Finder

The above solutions appear to work but I actually did it in the props.conf as a new field:

EVAL-bandwidth_mbps = case(substr(bandwidth,len(bandwidth)-3,4)="Gbps",tonumber(substr(bandwidth,1,len(bandwidth)-5))*1000,substr(bandwidth,len(bandwidth)-3,4)="Mbps",tonumber(substr(bandwidth,1,len(bandwidth)-5)))

EVAL-pps_kpps = case(substr(pps,len(pps)-3,4)="Kpps",tonumber(substr(pps,1,len(pps)-5)),substr(pps,len(pps)-2,3)="pps",tonumber(substr(pps,1,len(pps)-4)))

This was better for my application.

View solution in original post

0 Karma

sswansonchtr
Path Finder

The above solutions appear to work but I actually did it in the props.conf as a new field:

EVAL-bandwidth_mbps = case(substr(bandwidth,len(bandwidth)-3,4)="Gbps",tonumber(substr(bandwidth,1,len(bandwidth)-5))*1000,substr(bandwidth,len(bandwidth)-3,4)="Mbps",tonumber(substr(bandwidth,1,len(bandwidth)-5)))

EVAL-pps_kpps = case(substr(pps,len(pps)-3,4)="Kpps",tonumber(substr(pps,1,len(pps)-5)),substr(pps,len(pps)-2,3)="pps",tonumber(substr(pps,1,len(pps)-4)))

This was better for my application.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can make use of the built-in convert memk(field) command if your kilos are 2^10 rather than 10^3:

| stats count | eval bw = "6.55 Gbps,5.66 Mbps" | makemv delim="," bw | mvexpand bw | eval bw = replace(bw, " (\w)bps$", "\1") | convert memk(bw) | eval bw = tostring(round(bw/1048576, 2))+" Gbps"

That fiddles with the bandwidth field to make it read "6.55G" and "5.66M" instead of the spaced Gbps, converts to K using power-of-two, converts from K to G, adds back the fancy unit.

0 Karma

linu1988
Champion

Hello,
Assuming you have your values are coming as mention in the field say "a" the search would go like this

source=x  |eval b=if(like(a,"%Gb%"),1,0)|eval c=split(a," ")|eval d=mvindex(c,0)|eval d1=mvindex(c,1)|eval d1=replace(d1,"M","G")|eval d2=mvindex(c,2)|eval d=d/1000|eval d=d." ".d1." ".d2|eval a=if(b==0,d,a)|table a

Thanks

0 Karma

sswansonchtr
Path Finder

Here is an example:

"6.55 Mbps/7.42 Kpps"
or
"6.55 Gbps/72.4 Kpps"

They are extracted in the same field. Just need to be converted to similar types of data.

0 Karma

linu1988
Champion

Howz the log look like? means how the field is populated? any sample value?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...