Getting Data In

Calculating bandwidth usage of Windows machines using WMI and Splunk

nk-1
Path Finder

In C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf:

[perfmon://Network Interface]
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 10
object = Network Interface
index = wmi

SplunkWeb Query:

earliest=-1d host=MyHost sourcetype="Perfmon:Network Interface" | eval MB_Usage=10*Value/1024/1024| timechart span=1h sum(MB_Usage)

(multiplying by 10 because interval=10 and WMI metric is Bytes/sec?)

Would that give me MB Usage by hour for the given host?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Seems reasonable. I'd verify by doing something like this, and checking for reasonableness and number of events ...

earliest=-1d@d+600m latest=-1d@d+610m 
host=MyHost sourcetype="Perfmon:Network Interface" 
| eval MB_Usage=10*Value/1024/1024

You could also do this...

earliest=-1d host=MyHost sourcetype="Perfmon:Network Interface" 
| eval MB_Usage=3600*Value/1024/1024 
| timechart span=1h avg(MB_Usage)

If the value number is per second, then 3600 times that value number is the data per hour at that moment, and the average of those will approximate the total amount that particular hour.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...