bandwidth utilization percentage

[ayomotukoya]

I have the below search and I want to modify it to get the bandwidth utilization percentage. Whats the best way to go about that and what should I add to my search?

index=snmp sourcetype=snmp_attributes Name=ifHCInOctets host=xyz
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsIn=delta*8/1024/1024
| append
[search index=snmp sourcetype=snmp_attributes Name=ifHCOutOctets host=xyz
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsOut=delta*8/1024/1024 ]
| search UID=1
| timechart span=5m per_second(mbpsIn) AS MbpsIn per_second(mbpsOut) AS MbpsOut BY UID

[ayomotukoya]

10 mbs

[PickleRick]

1. How do you define percentage?

2. You're overthinking your search with this append thingy. You should search for both Names and streamstats by Name. Append uses subsearch and it has its limitations so you might be getting wrong results and not even knowing it.

[ayomotukoya]

Percentage of bandwidth utilized. I’m thinking bytes in+bytes out/1024 then I’m stumped from there

[PickleRick]

Yes but percentage is counted from a value against some bigger total. What would be the total in your case?

[ayomotukoya]

10 mb

[PickleRick]

Ah, so if it's a static value, you just do something like

| eval inpercentage=Mbpsin/10*100

(or (10*1024*1024), or whatever static value you calculate it against; didn't check your scale). No magic here.

[ayomotukoya]

When I run the search I dont get a field for Bytesinpercentage

index=snmp sourcetype=snmp_attributes Name=ifHCInOctets host=a154
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsIn=delta*8/1024/1024
| append
[search index=snmp sourcetype=snmp_attributes Name=ifHCOutOctets host=a154
| streamstats current=t global=f window=2 range(Value) AS delta BY UID
| eval mbpsOut=delta*8/1024/1024 ]
| search UID=1
| timechart span=5m per_second(mbpsIn) AS MbpsIn per_second(mbpsOut) AS MbpsOut BY UID
| eval Bytesinpercentage=MbpsIn/10*1024*1024

[PickleRick]

Ahhh... right. It's timechart with a BY clause so you'll have separate series for each UID. So if there is a small, fixed set of those UIDs you can do separate eval for each of those fields; you have to adjust the names of course. (If you have too many series your timechart will get clogged anyway).

Alternatively you can loop over those fields with a foreach command.

[ayomotukoya]

Spl isn’t really my strong suit. Would you mind showing me how you’d do it for this UID?

[PickleRick]

Well, you have this

| search UID=1

part in your search which means that you're effectively getting just two series in output.

And if you want the data for just this UID, it's best to filter your data as early as possible so that Splunk doesn't drag all unnecessary data along just to filter most of it out at the end. So you can completely refactor your search to something like.

index=snmp sourcetype=snmp_attributes Name IN (ifHCInOctets,ifHCOutOctets) host=xyz UID=1
| streamstats current=t global=f window=2 range(Value) AS delta BY  Name
| eval mbps=delta*8/1024/1024
| timechart span=5m per_second(mbps) AS Mbps BY Name

This should give you two series as output - ifHCInOctets and ifHCOutOctets.

You can of course

| rename ifHCInOctets as In, ifHCOutOctets as Out

for brevity.

And now you can just do

| eval InPerc=In/(10*1024*1024)
| eval OutPerc=Out/(10*1024*1024)

You can multiply it by 100 if you want actual percents.