Splunk Search

calculating average bandwidth

DTERM
Contributor

I've got a log that looks like the following after extraction....

RPD_MPLS_PATH_UP: MPLS path up on LSP host1 path bandwidth 12471992 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host2 path bandwidth 12011384 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 287627232 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 139387648 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host5 path bandwidth 12090064 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hosta) bandwidth changed, path bandwidth 55613496 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hostb) bandwidth changed, path bandwidth 75705096 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hostb) bandwidth changed, path bandwidth 830783296 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host3 (lsp hostc) bandwidth changed, path bandwidth 821814080 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hosta) bandwidth changed, path bandwidth 818999808 bps

My question is how can I calculate the average bandwidth from that log?

I've tried several different variations of the following with no luck...

| rex field=_raw "bandwidth (?)" | stats avg(bandwidth)

Tags (1)
0 Karma

jharty_splunk
Splunk Employee
Splunk Employee

Try this:

RPD_MPLS_PATH* | rex field=_raw "path bandwidth (?\w+)"

You need to specify the field vale (w+)

Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...