Hi:
I'm new to Splunk and I've been trying to run the following query for a couple of weeks but I only get data for the current date:
sourcetype="bcoat_proxysg" action!="TCP_HIT" | eval P1=split(proxy_server,"G")|eval GW=mvindex(P1,0)|eval Gateway=if(GW = "xx1","Site1", if(GW="xx2","Site2", GW))|eventstats sum(cs_bytes) as dl by Gateway|timechart count(eval(dl/1048576)) as "Download (MBytes)" by Gateway span=24h
OR
sourcetype="bcoat_proxysg" action!="TCP_HIT" | eval P1=split(proxy_server,"G")|eval GW=mvindex(P1,0)|eval Gateway=if(GW = "xx1","DCW", if(GW="xx2","DCE", GW))|eventstats sum(cs_bytes) as dl by Gateway|bucket _time span=24h|convert timeformat="%m/%d/%Y" ctime(_time) AS c_time|chart count(eval(dl/1048576)) as "Download (MBytes)" over c_time by Gateway
In short, I'm trying to get the downloads (sc_bytes) in Megabytes (the information is provided in bytes) by Gateway per day.
Can anybody point me to what I am doing wrong?
Thanks!
Firstly, I managed to produce some results with your search, though I had to modify it to work with access_combined
, (bytes
instead of cs_bytes
, clientip
instead of Gateway
etc)
I think you are using count
in the wrong way, at least if you want to find the amount of data being transferred. Try the eval
for the bytes -> megabytes first, and make a sum
in the timechart
.
sourcetype="bcoat_proxysg" action!="TCP_HIT" | eval P1=split(proxy_server,"G")|eval GW=mvindex(P1,0)|eval Gateway=if(GW = "xx1","Site1", if(GW="xx2","Site2", GW))| eval MB=cs_bytes/1024/1024| timechart sum(MB) as "Download (MBytes)" by Gateway span=24h
Hope this helps,
Kristian
Hi Kristian:Thanks a lot for the example! Seems to be working better. However, I'm still getting data only for the current date or the last date in the selected custom range. All other dates return no data.:(