How do I change the value of a search to MB?

[marcusmartin]

I have this search which shows the total of bytes coming in for a particular time period. Can someone tell me how to change the search so i can have the value changed to MB? I understand i should maybe be using the eval function but, try as i might, i can't seem to get the output i want.

sourcetype="microsoft:forefront:tmg:proxy" | stats Sum(sc_bytes) 

[richgalloway · Accepted solution]

To convert bytes to MB, divide by 1024 twice.

sourcetype="microsoft:forefront:tmg:proxy" | stats Sum(sc_bytes) as sum_bytes | eval sum_MB=sum_bytes/1024/1024

[marcusmartin]

Oooooooh I was so close, I had all the words just in the wrong order 🙂 thanks so much. Just need to truncate it now