Splunk Search

How to modify my search so it shows total MB per user for the day?

cm22486
Path Finder
bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, values(User_Name), values(MBytes_Moved) by _time 

Above is my current search, but only shows the total MB moved by all users. I want to show total MB moved, per user, for the day.

What I am looking for would be:

Date                    MBytes_Moved          User
Sept 20, 2016           2347                  john.smith
                        4675                  john.wagner
                        534                   mike.smith
                        1215                  pablo.johnson
Sept 21, 2016           953                   john.smith
                        3246                  lonnie.murray
                        2312                  max.effort
Sept 22, 2016           2347                  jason.adams
                        9087                  john.doe
                        5876                  william.shelton 

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved values(User_Name) values(MBytes_Moved) by _time

Updated#2 for File_Moved column

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved count as File_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved list(User_Name) list(MBytes_Moved) list(File_Moved) as File_Moved by _time

View solution in original post

masonmorales
Influencer
 bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved by _time User_Name
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved values(User_Name) values(MBytes_Moved) by _time

Updated#2 for File_Moved column

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved count as File_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved list(User_Name) list(MBytes_Moved) list(File_Moved) as File_Moved by _time

cm22486
Path Finder

Ahh we're close! Nice work and thank you! Last but not least, I forgot to include my "Files Moved" column in all of that. This is how I achieved "Files Moved" before, how could we append this?

stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, Count(_time) as Files_Moved by User_Name
0 Karma

somesoni2
SplunkTrust
SplunkTrust

See the updated answer...

cm22486
Path Finder
0 Karma

cm22486
Path Finder

That is a link to the screenshot of my results, we are so close, thanks for all the help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The values aggregation function remove duplicate values and there could very well be duplicate/same count of files moved. Instead of values function, use list function instead. I've updated the answer.

cm22486
Path Finder

He shoots he scores! Thanks so much, you're a wizard.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...