Splunk Search

Stats against timechart

hlarimer
Communicator

I have a search that I can use in a dashboard that gives me statistical data about bandwidth usage on a firewall. I have a drop down that sets the location ($location$) that the user wants to query and then shows them the max mbps up and down. Here is that search:

index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust  $location$  
|  eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 
| eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000 
| timechart span=1s sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS  Up 
| stats max(*)

I would like to create a report that shows bandwidth usage per site and thought it would be as simple as adding "by host" to the end but the search doesn't show anything under the statistics tab. I'm assumed the host information isn't being sent to the last stats command so I tried adding "by host" to the timechart command but it still doesn't show results.

Any ideas on how to get this report?

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this...

 index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust  $location$  
 |  eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 
 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000  | bucket span=1s _time
 | stats sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS  Up by _time host | fields - _time
 | stats max(*) as * by host

View solution in original post

woodcock
Esteemed Legend

You lost host at timechart so you need to keep it there like this:

index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust  $location$ | eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000 | timechart span=1s sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS Up by host | stats max(*) by host
0 Karma

somesoni2
Revered Legend

You would loose host even after specifying it in by clause of timechart (the host values will appear as field name).

woodcock
Esteemed Legend

Yes, of course, you need this:

index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust  $location$ | eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000 | bucket _time span=1s | stats sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS Up by _time host | stats max(*) by host

Which I see @somesoni2 has already noted (what he said).

0 Karma

hlarimer
Communicator

That's what I was thinking but when I tried that it still didn't give me any data

0 Karma

somesoni2
Revered Legend

Try this...

 index=pan_logs sourcetype=pan_traffic src_zone=ClientVPNZone OR src_zone=trust dst_zone=Untrust  $location$  
 |  eval mbits_sec_down=(bytes_received/elapsed_time)*8/1000/1000 
 | eval mbits_sec_up=(bytes_sent/elapsed_time)*8/1000/1000  | bucket span=1s _time
 | stats sum(mbits_sec_down) AS Down, sum(mbits_sec_up) AS  Up by _time host | fields - _time
 | stats max(*) as * by host

View solution in original post

somesoni2
Revered Legend

Bucket + stats will give similar result as timechart.

0 Karma

hlarimer
Communicator

I didn't get any results off of the search listed in your first response

0 Karma

hlarimer
Communicator

I take that back, I had to remove the variable name left in there from the dashboard and I'm seeing data now.

0 Karma