Splunk Search

How to convert Bytes to Mbytes in a search?

blebit
Path Finder

Hi everyone

I have this field: File_Size="File size (bytes): [byte_size]", where byte_size is nr; e.g File_Size="File size (bytes): 14642"... and I want to convert it to MB

Can anyone help me on this?

Thank you

richgalloway
SplunkTrust
SplunkTrust

Do this.

... | eval MB_size=byte_size/(1024*1024) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

rafamss
Contributor

Hi blebit,

First, I'll a regex for get this content like as : rex max_match=0 "(?File_Size="File size (bytes): =.*)" ;
Second, I would do a simple multiplication of the field Bytes per 1000 or 1024, as you see fit.

I hope have help.

Rafael Martins

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...