Splunk Search

Network Bandwidth Usage by url

ApolloJ
Engager

Hi,

I want to simply know bandwidth usage by url (I span on 10s for not flooding) then I divide by 10

I wrote this, it seems ok  (but not sure) -  is it correct ?


uri="/myappli/*" | timechart sum(eval(round(bytes/1024/1024))) AS MB span=10s

Thanks

 

 

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

View solution in original post

ApolloJ
Engager

Hi gcusello,
Thanks for the reply.
"By URI" is not necessary for my case (as I want all of them 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

you said that you need "bandwidth usage by uri".

anyway, did my answer solve your request?

If yes, please accept the answer, otherwise, tell me how can I help you.

ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @ApolloJ,

at first use always the index in the main search to have faster searches.

then the uri is missed in your timechart and in the round option the approx is missed.

Please try something like this:

index=your_index uri="/myappli/*" 
| timechart span=10s sum(round(bytes/1024/1024,2)) AS MB BY uri 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...