*Nix App - Network Throughput Calculations

[jdunlea_splunk]

Hi Guys,

I have some confusions around the Interface Throughput calculations.

The following search seems to be finding the average of the DIFFERENCE between the last TX value and the current TX value. What are the TX values representing? The current upload bytes for that poll period, or the accumulated upload bytes for that interface?

index="os" sourcetype="interfaces" host=* | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | timechart eval(sum(TX_Thruput_KB)/dc(time)) by Interface_Host

What are we trying to calculate here? Also, is this an accurate representation of bandwidth usage for that interface on a system?

Cheers,

John

[jdunlea_splunk]

Hi tiberious726,

So you are saying that the SEARCH is calculating the "accumulated total bytes", or that the straight TX value in the events is the "accumulated total bytes" (so that is why we are finding the difference between TXbytes and lastTX in this search)? The latter makes the most sense to me. What is strange , is that for some of my instances, I am seeing negative results for the different between the current TXbytes value and the lastTX.... which does not make any sense?