Splunk Search

Network Bandwidth Usage by url

ApolloJ
Engager

Hi,

I want to simply know bandwidth usage by url (I span on 10s for not flooding) then I divide by 10

I wrote this, it seems ok  (but not sure) -  is it correct ?


uri="/myappli/*" | timechart sum(eval(round(bytes/1024/1024))) AS MB span=10s

Thanks

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ApolloJ
Engager

Hi gcusello,
Thanks for the reply.
"By URI" is not necessary for my case (as I want all of them 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

at first use always the index in the main search to have faster searches.

then the uri is missed in your timechart and in the round option the approx is missed.

Please try something like this:

index=your_index uri="/myappli/*" 
| timechart span=10s sum(round(bytes/1024/1024,2)) AS MB BY uri 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...