Splunk Search

calculating average bandwidth

DTERM
Contributor

I've got a log that looks like the following after extraction....

RPD_MPLS_PATH_UP: MPLS path up on LSP host1 path bandwidth 12471992 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host2 path bandwidth 12011384 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 287627232 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 139387648 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host5 path bandwidth 12090064 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hosta) bandwidth changed, path bandwidth 55613496 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hostb) bandwidth changed, path bandwidth 75705096 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hostb) bandwidth changed, path bandwidth 830783296 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host3 (lsp hostc) bandwidth changed, path bandwidth 821814080 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hosta) bandwidth changed, path bandwidth 818999808 bps

My question is how can I calculate the average bandwidth from that log?

I've tried several different variations of the following with no luck...

| rex field=_raw "bandwidth (?)" | stats avg(bandwidth)

Tags (1)
0 Karma

jharty_splunk
Splunk Employee
Splunk Employee

Try this:

RPD_MPLS_PATH* | rex field=_raw "path bandwidth (?\w+)"

You need to specify the field vale (w+)

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...