query help with chart

[surekhasplunk]

Hi,

I have a csv file with inputs like this :

Time,Device,Interface,Duration,Bits In/sec,Bits Out/sec,BW
3/22/2019 12:26,A-01,Ethernet1/1,322,0.00000255,0.00000247,10000000000
3/22/2019 12:31,A-01,Ethernet1/1,317,0.00000247,0.00000247,10000000000
3/22/2019 12:37,A-01,Ethernet1/1,319,0.00000242,0.0000025,10000000000
3/22/2019 12:42,A-01,Ethernet1/1,320,0.00000248,0.0000024,10000000000

Now i need to show it in a graph like the attached picture where i can show in
x-axis the bandwidth usage and
y-axis i need Device:Interface name
and the usage details should come in the graph as shown in the screenshot. Please help asap.

[woodcock]

Like this:

... | eval bandwidthIn = Duration * 'Bits In/sec'
| eval bandwidthOut = Duration * 'Bits Out/sec'
| eval Device:Interface = Device . ":" . Interface
| stats sum(bandwidthIn) AS bandwidthIn sum(bandwidthOut) AS bandwidthOut BY Device:Interface

[surekhasplunk]

Hi @woodcock,

Whats the logic behind multiplying Duration with 'Bits In/Sec' and if we are multiplying with duration then should we not divide it by BW value ? Please suggest.

[woodcock]

You said you desired Bandwidth usage; that is how to calculate usage.

[surekhasplunk]

Ok.. thanks much @woodcock

[niketn]

@surekhasplunk I am confused. You have the data with fields and you have the expected chart in Splunk. Don't you already have the query? Is it assistance required with some assignment? or do you want something on top of the chart that has been attached?

[renjith_nair · Accepted solution]

@surekhasplunk,

Try

"your current search"
|eval Interfaces=Device.":".Interface
|stats sum("Bits In/sec") as BitsIn,sum("Bits Out/sec") as BitsOut by Interfaces

[surekhasplunk]

Thank you so much.