- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to figure out to calculate the network utilization on this server using the eval and stats and I'm having problem figuring out the correct search and expression, can you help me.
index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=*
| eval bytes_out = "Bytes Sent/sec", bytes_in = "Bytes Received/sec"
| eval Bandwidth = bytes_out + bytes_in
| timechart count by Bandwidth limit=10
I need to convert the bytes in mbps, as well, I would really appreciate some help here, Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much, search works, just slight modification on last pipe | timechart avg(bandwidth_mpbs)...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey
Run PerfMon from any command line (or type "Performance Monitor" in the Start menu), right-click on "Performance", select "Connect to another computer", and enter the IP address of the Nano Server computer you want to monitor.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much, search works, just slight modification on last pipe | timechart avg(bandwidth_mpbs)...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Happy to help! Sorry for the typo.. 😅
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi!
Something like this should help you:
index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=*
| eval bytes_out=if(counter="Bytes Sent/sec",Value,0), bytes_in=if(counter="Bytes Received/sec",Value,0)
| eval bandwidth_mbps=(bytes_out+bytes_in)/1024/1024
| timechart avg(bandwidth)
Please replace index=* with your index name, as it is bad practise to use index=*.
I'd strongly suggest doing the free Splunk Fundamentals 1 course, it will help you understand basic SPL better.
