Timechart vs. Chart (_time) to figure out bandwidth?

[albyva]

When trying to figure out bandwidth, which search string makes more sense?

| eval MBs=(bytes*8/1024/1024) | timechart sum(MBs) as "MB/s"

or

| eval MBs=(bytes*8/1024/1024) | chart sum(MBs) as "MB/s" by _time

[somesoni2 · Accepted solution]

You're trying to find bandwidth at a fixed interval? The timechart provides 'span' options without any extra line (a bucket command will be required for chart), so I will go for timechart.

[albyva]

Thanks for the incite about chart and needing a bucket. I think I'll stick with Timechart. Typically it is a fixed interval like 2hrs, 12hrs, or 24hrs.

[rickettw]

I am researching how to track spikes in bandwidth to see if individuals are using the network to for personal time like conducting personal business during lunch. From your answer above, have you any advice or experience to track bandwidth using Active Directory IDs rather than hardware types/routers?