Splunk Search

Network Bandwidth Usage by url

ApolloJ
Engager

Hi,

I want to simply know bandwidth usage by url (I span on 10s for not flooding) then I divide by 10

I wrote this, it seems ok  (but not sure) -  is it correct ?


uri="/myappli/*" | timechart sum(eval(round(bytes/1024/1024))) AS MB span=10s

Thanks

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ApolloJ
Engager

Hi gcusello,
Thanks for the reply.
"By URI" is not necessary for my case (as I want all of them 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

at first use always the index in the main search to have faster searches.

then the uri is missed in your timechart and in the round option the approx is missed.

Please try something like this:

index=your_index uri="/myappli/*" 
| timechart span=10s sum(round(bytes/1024/1024,2)) AS MB BY uri 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...