Skip to main content Link Search Menu Expand Document (external link)

Examples - Total Bytes Used

Table of contents
  1. Total Bytes
  2. Total Bytes per Hour

Total Bytes

function totalbytes()
    search {from="-30d<d", to="-20d>d"} sContent("@source","surf-soho-6ccb")
    let sent=f("@fields.bytes_sent"),recvd=f("@fields.bytes_recvd"),session=f("@fields.session_state")
    let sent2=parseInt(sent),recvd2=parseInt(recvd)
    where session=="END"
    aggregate s=sum(sent2+recvd2)
stream totalbytes = totalbytes()

The total bytes used is 19347219046 bytes, equal to ~18 GB.

In this case, there are two variables, “@fields.bytes_sent” and “@fields.bytes_recvd”, indicate the bytes sent and received, respectively. However, the bytes are stored in a format of string. Then it’s necessary to convert them into integers before calculation, using parseInt. The last step is using aggregate (without by) to get the total bytes.

Related FPL command: search;sContent;let;f;parseInt;where;aggregate;stream

Total Bytes per Hour

function totalbytes_per_hour()
    search {from="-30d<d", to="-20d>d"} sContent("@source","surf-soho-6ccb")
    let sent=f("@fields.bytes_sent"),recvd=f("@fields.bytes_recvd"),session=f("@fields.session_state"),timestamp=f("@timestamp")
    let sent2=parseInt(sent),recvd2=parseInt(recvd)
    where session=="END"
    let Hour=strftime("%D:%H:%M",timebucket("1h",timestamp))  
    aggregate s=sum(sent2+recvd2) by Hour
stream totalbytes_per_hour = totalbytes_per_hour()

If you want to calculate the total bytes per hour, what you should do first is to divide the timestamp into a interval of 1h using strftime and timebucket(“Hour”). Then, compared to the last example, a by is needed in the aggregate command, which means aggregating by “Hour”.

Related FPL command: search;sContent;let;f;parseInt;where;strftime;timebucket;aggregate;stream