Splunk Search

Timechart vs. Chart (_time) to figure out bandwidth?

Communicator

When trying to figure out bandwidth, which search string makes more sense?

| eval MBs=(bytes*8/1024/1024) | timechart sum(MBs) as "MB/s"

or

| eval MBs=(bytes*8/1024/1024) | chart sum(MBs) as "MB/s" by _time

1 Solution

Revered Legend

You're trying to find bandwidth at a fixed interval? The timechart provides 'span' options without any extra line (a bucket command will be required for chart), so I will go for timechart.

View solution in original post

Revered Legend

You're trying to find bandwidth at a fixed interval? The timechart provides 'span' options without any extra line (a bucket command will be required for chart), so I will go for timechart.

View solution in original post

Communicator

Thanks for the incite about chart and needing a bucket. I think I'll stick with Timechart. Typically it is a fixed interval like 2hrs, 12hrs, or 24hrs.

0 Karma

New Member

I am researching how to track spikes in bandwidth to see if individuals are using the network to for personal time like conducting personal business during lunch. From your answer above, have you any advice or experience to track bandwidth using Active Directory IDs rather than hardware types/routers?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!