Splunk Search

Percentage network bandwidth by site

aaronnicoli
Path Finder

Hi all,

Another question...
I have two extracted fields: "MB" and "site".

I wish to do the following, over a period in time, calculate the total MB in my data.

base search | stats sum(MB) as MBdata by site

Results in a table: MBdata and site, thus the MB of data used per website, fairly simple...

Now, I want to bring in a percentage... (the hard part)

What I want to achieve is this, a table, listing sites and the percentage of "total data" each have used.

Any help?

Thanks,
Aaron.

0 Karma
1 Solution

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

View solution in original post

BobM
Builder

You need to use eventstats and eval. Assuming you want it to 2dp try

base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total

Bob

aaronnicoli
Path Finder

Doesn't matter yours worked first try... Thanks for the help, very much appreciate it.

0 Karma

BobM
Builder

Damn 20 sec too late

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...