Splunk Search

Network Bandwidth Usage by url

ApolloJ
Engager

Hi,

I want to simply know bandwidth usage by url (I span on 10s for not flooding) then I divide by 10

I wrote this, it seems ok  (but not sure) -  is it correct ?


uri="/myappli/*" | timechart sum(eval(round(bytes/1024/1024))) AS MB span=10s

Thanks

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ApolloJ
Engager

Hi gcusello,
Thanks for the reply.
"By URI" is not necessary for my case (as I want all of them 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

at first use always the index in the main search to have faster searches.

then the uri is missed in your timechart and in the round option the approx is missed.

Please try something like this:

index=your_index uri="/myappli/*" 
| timechart span=10s sum(round(bytes/1024/1024,2)) AS MB BY uri 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Platform | Upgrading your Splunk Deployment to Python 3.9

Splunk initially announced the removal of Python 2 during the release of Splunk Enterprise 8.0.0, aiming to ...

From Product Design to User Insights: Boosting App Developer Identity on Splunkbase

co-authored by Yiyun Zhu & Dan Hosaka Engaging with the Community at .conf24 At .conf24, we revitalized the ...

Detect and Resolve Issues in a Kubernetes Environment

We’ve gone through common problems one can encounter in a Kubernetes environment, their impacts, and the ...