Splunk Search

Percentage network bandwidth by site

aaronnicoli
Path Finder

Hi all,

Another question...
I have two extracted fields: "MB" and "site".

I wish to do the following, over a period in time, calculate the total MB in my data.

base search | stats sum(MB) as MBdata by site

Results in a table: MBdata and site, thus the MB of data used per website, fairly simple...

Now, I want to bring in a percentage... (the hard part)

What I want to achieve is this, a table, listing sites and the percentage of "total data" each have used.

Any help?

Thanks,
Aaron.

0 Karma
1 Solution

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

View solution in original post

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

aaronnicoli
Path Finder

Doesn't matter yours worked first try... Thanks for the help, very much appreciate it.

0 Karma

BobM
Builder

Damn 20 sec too late

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...