How to sum the website's traffic?

[houys]

Hi Community,

We are using the Splunk Enterprise. From the Splunk Search & Reporting, how can we sum the site's traffic, like the monthly bandwidth?

Thanks,

Steve

[houys]

Hi @gcusello,

We have all Drupal sites and the raw log likes this:

{"time":"2024-07-18T09:29:59.900525659-05:00","stream":"stdout","logtag":"F","message":"10.42.11.59 - - [18/Jul/2024:14:29:59 +0000] \"POST / HTTP/1.1\" 200 46989 \"-\" \"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.17628; Pro)\"","kubernetes":{"pod_name":"apache-4","namespace_name" ...

We want to calculate total bandwidth.

[yuanliu]

The "message" node in the event is an Apache HTTPD access log.  So, apply Splunk's built-in access-extraction to it. ("message" should have been extracted by Splunk already.)

| rename message as _raw
| extract access-extractions
| timechart span=1month sum(bytes) as total_traffic

Your sample will give

total_traffic

46989

Here is an emulation using the sample you give, corrected for JSON completion:

| makeresults
| eval _raw = "{\"time\":\"2024-07-18T09:29:59.900525659-05:00\",\"stream\":\"stdout\",\"logtag\":\"F\",\"message\":\"10.42.11.59 - - [18/Jul/2024:14:29:59 +0000] \\\"POST / HTTP/1.1\\\" 200 46989 \\\"-\\\" \\\"Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.17628; Pro)\\\"\",\"kubernetes\":{\"pod_name\":\"apache-4\",\"namespace_name\":\"some name\"}"
| spath
| eval _time = strptime(time, "%FT%T.%9N%z")
``` data emulation ```

Play with it and compare with real data

[houys]

Hi @yuanliu 

That's work, Thanks

[gcusello]

Hi @houys ,

your question is too vague, could you better describe your data?

which data sources (technologies)?

Ciao.

Giuseppe