Splunk Search

How to modify my search so it shows total MB per user for the day?

cm22486
Path Finder
bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, values(User_Name), values(MBytes_Moved) by _time 

Above is my current search, but only shows the total MB moved by all users. I want to show total MB moved, per user, for the day.

What I am looking for would be:

Date                    MBytes_Moved          User
Sept 20, 2016           2347                  john.smith
                        4675                  john.wagner
                        534                   mike.smith
                        1215                  pablo.johnson
Sept 21, 2016           953                   john.smith
                        3246                  lonnie.murray
                        2312                  max.effort
Sept 22, 2016           2347                  jason.adams
                        9087                  john.doe
                        5876                  william.shelton 

Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved values(User_Name) values(MBytes_Moved) by _time

Updated#2 for File_Moved column

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved count as File_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved list(User_Name) list(MBytes_Moved) list(File_Moved) as File_Moved by _time

View solution in original post

masonmorales
Influencer
 bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved by _time User_Name
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved values(User_Name) values(MBytes_Moved) by _time

Updated#2 for File_Moved column

your base search |  bucket _time span=1d| eval  _time = strftime(_time,"%b %d, %Y")| stats sum(Bytes_Written) as MBytes_Moved count as File_Moved by _time User_Name | eval MBytes_Moved=MBytes_Moved/(1024*1024) | stats sum(MBytes_Moved) as MBytes_Moved list(User_Name) list(MBytes_Moved) list(File_Moved) as File_Moved by _time

cm22486
Path Finder

Ahh we're close! Nice work and thank you! Last but not least, I forgot to include my "Files Moved" column in all of that. This is how I achieved "Files Moved" before, how could we append this?

stats sum(eval(Bytes_Written/(1024*1024))) as MBytes_Moved, Count(_time) as Files_Moved by User_Name
0 Karma

somesoni2
SplunkTrust
SplunkTrust

See the updated answer...

cm22486
Path Finder
0 Karma

cm22486
Path Finder

That is a link to the screenshot of my results, we are so close, thanks for all the help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The values aggregation function remove duplicate values and there could very well be duplicate/same count of files moved. Instead of values function, use list function instead. I've updated the answer.

cm22486
Path Finder

He shoots he scores! Thanks so much, you're a wizard.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...