I am trying to produce a gauge which will display the current percentage used of my fixed monthly bandwidth of 200GB.
I have managed to calculate the total used by doing:
stats sum(Received) | rename sum(Received) as TReceived
This then displays the total number of bytes I have received in TReceived and I set the time range to the current month. I can't figure out how to do something like "Usage=100*(214748364800/TReceived)" in Splunk
214748364800 = 200GB
I am stuck please help.
You could also use the "gauge" command:
stats sum(Received) as TR|eval U=(TR/214748364800)*100|gauge U
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Gauge
This looks like it would work too and slightly easier. Will give it a go later.