Splunk Search

calculating average bandwidth

DTERM
Contributor

I've got a log that looks like the following after extraction....

RPD_MPLS_PATH_UP: MPLS path up on LSP host1 path bandwidth 12471992 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host2 path bandwidth 12011384 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 287627232 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 139387648 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host5 path bandwidth 12090064 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hosta) bandwidth changed, path bandwidth 55613496 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hostb) bandwidth changed, path bandwidth 75705096 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hostb) bandwidth changed, path bandwidth 830783296 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host3 (lsp hostc) bandwidth changed, path bandwidth 821814080 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hosta) bandwidth changed, path bandwidth 818999808 bps

My question is how can I calculate the average bandwidth from that log?

I've tried several different variations of the following with no luck...

| rex field=_raw "bandwidth (?)" | stats avg(bandwidth)

Tags (1)
0 Karma

jharty_splunk
Splunk Employee
Splunk Employee

Try this:

RPD_MPLS_PATH* | rex field=_raw "path bandwidth (?\w+)"

You need to specify the field vale (w+)

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...