How to convert kb to GB?

[peasead]

How do I convert this query to display the results in GB instead of kb?

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(kb) by series

Currently I'm just do a ~result~/1024^2 in Excel, but it'd be stellar to not have to do that as I'm sure Splunk can do the conversion for me.

Also, is there an efficient way to get the results to be listed by Source instead of Source Type? Replacing "per_sourcetype_thruput" with "per_source_thruput" displays all the individual .log files and takes a long long time to complete. If that's the only way, that's fine, I just didn't know if there was another way.

[ldongradi_splun]

You can use the power of 1024, and anticipate the use of a macro, plus you need to use eval out of the sum() if you want to round the results:
index="_internal" source="*metrics.log" per_sourcetype_thruput| chart sum(kb) as Size by series
| eval KB=round(Size/pow(1024,0),2), MB=round(Size/pow(1024,1),2), GB=round(Size/pow(1024,2),2)
| table series, Size, KB, MB, GB


[hexx · Accepted solution]

Very simple :

index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb/1024/1024)) AS GB by series

I am not sure of how you would like results to be listed by source other than by listing all file names / input sources. Could you elaborate on that? What kind of report would you like to see?

[peasead]

Thanks!

That worked!

[tfujita_splunk]

This could be also solution for you.

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))

Another option is installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2).

Example

index="_internal" source="*metrics.log" per_sourcetype_thruput
| chart sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)

Numeral system macros for Splunk

https://splunkbase.splunk.com/app/6595

Usage:

How to convert a large number to string with expressions of long and short scales, or neither.

https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressio......