Splunk Search

Network Bandwidth Usage by url

ApolloJ
Engager

Hi,

I want to simply know bandwidth usage by url (I span on 10s for not flooding) then I divide by 10

I wrote this, it seems ok  (but not sure) -  is it correct ?


uri="/myappli/*" | timechart sum(eval(round(bytes/1024/1024))) AS MB span=10s

Thanks

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ApolloJ
Engager

Hi gcusello,
Thanks for the reply.
"By URI" is not necessary for my case (as I want all of them 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

at first use always the index in the main search to have faster searches.

then the uri is missed in your timechart and in the round option the approx is missed.

Please try something like this:

index=your_index uri="/myappli/*" 
| timechart span=10s sum(round(bytes/1024/1024,2)) AS MB BY uri 

Ciao.

Giuseppe

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...