Splunk Search

Percentage network bandwidth by site

aaronnicoli
Path Finder

Hi all,

Another question...
I have two extracted fields: "MB" and "site".

I wish to do the following, over a period in time, calculate the total MB in my data.

base search | stats sum(MB) as MBdata by site

Results in a table: MBdata and site, thus the MB of data used per website, fairly simple...

Now, I want to bring in a percentage... (the hard part)

What I want to achieve is this, a table, listing sites and the percentage of "total data" each have used.

Any help?

Thanks,
Aaron.

0 Karma
1 Solution

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

View solution in original post

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

aaronnicoli
Path Finder

Doesn't matter yours worked first try... Thanks for the help, very much appreciate it.

0 Karma

BobM
Builder

Damn 20 sec too late

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...