windows perfmon network utilization

[ggfsplunk]

I'm trying to figure out to calculate the network utilization on this server using the eval and stats and I'm having problem figuring out the correct search and expression, can you help me.

index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=*
| eval bytes_out = "Bytes Sent/sec", bytes_in = "Bytes Received/sec"
| eval Bandwidth = bytes_out + bytes_in
| timechart count by Bandwidth limit=10

I need to convert the bytes in mbps, as well, I would really appreciate some help here, Thank you in advance.

[snehalharshe16]

Hey

Run PerfMon from any command line (or type "Performance Monitor" in the Start menu), right-click on "Performance", select "Connect to another computer", and enter the IP address of the Nano Server computer you want to monitor. 

[ggfsplunk · Accepted solution]

Thank you so much, search works, just slight modification on last pipe | timechart avg(bandwidth_mpbs)...

[lydiapal_splunk]

Happy to help! Sorry for the typo.. 😅

[lydiapal_splunk]

Hi!

Something like this should help you:

index=* sourcetype="Perfmon:Network Interface" source="Perfmon:Network Interface" counter=*
| eval bytes_out=if(counter="Bytes Sent/sec",Value,0), bytes_in=if(counter="Bytes Received/sec",Value,0)
| eval bandwidth_mbps=(bytes_out+bytes_in)/1024/1024
| timechart avg(bandwidth)

Please replace index=* with your index name, as it is bad practise to use index=*.

I'd strongly suggest doing the free Splunk Fundamentals 1 course, it will help you understand basic SPL better.