Splunk Search

How to convert bytes to megabytes for use in my timechart search?

sundaresh83
Explorer

Hi,

I am writing a search:

timechart span=1h sum(Bytes) AS "MBytes "

In the same search, I want it to return Mb instead of bytes ie. bytes/1000000.
So I tried:

stats sum(eval in_mB =Bytes/1000000) as "MBytes" 

But just eval in_mB =Bytes/1000000 works. Can I store this as a column for future use instead of rewriting it? How do I do it?

Tags (3)
1 Solution

ppablo
Retired

Hi sundaresh83

What if you just do the eval conversion separately before the timechart?

(your base search) | eval in_mB=Bytes/1000000 | timechart span=1h sum(in_mB) as "MBytes"

View solution in original post

0 Karma

Patient
Path Finder

Hi,

Try with:

 | eval megabytes=((bytes/1024)/1024) | timechart sum(megabytes)

Patient
Path Finder

Hi!

have you tried with the above search query?

0 Karma

Patient
Path Finder

Thank you for your vote!

0 Karma

sundaresh83
Explorer

works... thanks...

0 Karma

ppablo
Retired

Hi sundaresh83

What if you just do the eval conversion separately before the timechart?

(your base search) | eval in_mB=Bytes/1000000 | timechart span=1h sum(in_mB) as "MBytes"
0 Karma

Patient
Path Finder

Hi!
Note that 1Mb=1024*1024 Bytes

0 Karma

ppablo
Retired

yup, @Patient's calculation below will be more accurate

0 Karma

sundaresh83
Explorer

@ppablo_splunk
This will work, but I do now want it to return the "in_mB value and the sum value.
I want my query to return only the sum value in MB.

0 Karma

sundaresh83
Explorer

works... thanks..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...