Splunk Search

calculating average bandwidth

DTERM
Contributor

I've got a log that looks like the following after extraction....

RPD_MPLS_PATH_UP: MPLS path up on LSP host1 path bandwidth 12471992 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host2 path bandwidth 12011384 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 287627232 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 139387648 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host5 path bandwidth 12090064 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hosta) bandwidth changed, path bandwidth 55613496 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hostb) bandwidth changed, path bandwidth 75705096 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hostb) bandwidth changed, path bandwidth 830783296 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host3 (lsp hostc) bandwidth changed, path bandwidth 821814080 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hosta) bandwidth changed, path bandwidth 818999808 bps

My question is how can I calculate the average bandwidth from that log?

I've tried several different variations of the following with no luck...

| rex field=_raw "bandwidth (?)" | stats avg(bandwidth)

Tags (1)
0 Karma

jharty_splunk
Splunk Employee
Splunk Employee

Try this:

RPD_MPLS_PATH* | rex field=_raw "path bandwidth (?\w+)"

You need to specify the field vale (w+)

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...