Splunk Search

How to convert bytes to megabytes for use in my timechart search?

sundaresh83
Explorer

Hi,

I am writing a search:

timechart span=1h sum(Bytes) AS "MBytes "

In the same search, I want it to return Mb instead of bytes ie. bytes/1000000.
So I tried:

stats sum(eval in_mB =Bytes/1000000) as "MBytes" 

But just eval in_mB =Bytes/1000000 works. Can I store this as a column for future use instead of rewriting it? How do I do it?

Tags (3)
1 Solution

ppablo
Retired

Hi sundaresh83

What if you just do the eval conversion separately before the timechart?

(your base search) | eval in_mB=Bytes/1000000 | timechart span=1h sum(in_mB) as "MBytes"

View solution in original post

0 Karma

Patient
Path Finder

Hi,

Try with:

 | eval megabytes=((bytes/1024)/1024) | timechart sum(megabytes)

Patient
Path Finder

Hi!

have you tried with the above search query?

0 Karma

Patient
Path Finder

Thank you for your vote!

0 Karma

sundaresh83
Explorer

works... thanks...

0 Karma

ppablo
Retired

Hi sundaresh83

What if you just do the eval conversion separately before the timechart?

(your base search) | eval in_mB=Bytes/1000000 | timechart span=1h sum(in_mB) as "MBytes"
0 Karma

Patient
Path Finder

Hi!
Note that 1Mb=1024*1024 Bytes

0 Karma

ppablo
Retired

yup, @Patient's calculation below will be more accurate

0 Karma

sundaresh83
Explorer

@ppablo_splunk
This will work, but I do now want it to return the "in_mB value and the sum value.
I want my query to return only the sum value in MB.

0 Karma

sundaresh83
Explorer

works... thanks..

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...