Splunk Search

Percentage network bandwidth by site

aaronnicoli
Path Finder

Hi all,

Another question...
I have two extracted fields: "MB" and "site".

I wish to do the following, over a period in time, calculate the total MB in my data.

base search | stats sum(MB) as MBdata by site

Results in a table: MBdata and site, thus the MB of data used per website, fairly simple...

Now, I want to bring in a percentage... (the hard part)

What I want to achieve is this, a table, listing sites and the percentage of "total data" each have used.

Any help?

Thanks,
Aaron.

0 Karma
1 Solution

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

View solution in original post

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

aaronnicoli
Path Finder

Doesn't matter yours worked first try... Thanks for the help, very much appreciate it.

0 Karma

BobM
Builder

Damn 20 sec too late

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...