0
1

More than 1 year has passed since last update.

# Splunkで大きな数のBytesを人が見やすい単位（KiB, MiB, GiB）に変換する方法 / How to convert large bytes to human readable units (e.g. Kib, MiB, GiB)

Last updated at Posted at 2023-02-04

English follows Japanese

# Numeral system macros for Splunk v1.1.1

Prev article "How to format large number to display millions?"

## バイト数も変換できるようになりました。 / Bytes to printing Human readable size (e.g. 4KiB, 1023.4MiB, 23.4GiB, 345,67TiB)

Bytesを1024の累乗で割って、人が読みやすい単位（キロバイト、メガバイト等）に変換する必要があることが時々あります。
その際、SPLに毎回その計算を書いてSPLが長くなると見栄えが悪いので、

Sometimes it is necessary to divide Bytes by powers of 1024 and convert it to human readable units.
In that case, it would not look good if you write that calculation in the SPL each time and the SPL becomes long,
so I think it would be good if we could use a common macro to make it simple.

この目的のため、以下の2つのマクロを Numeral system macros for Splunk v1.1.1 に追加しました。

For this purpose, I added 2 macros to Numeral system macros for Splunk v1.1.1.

• `numeral_binary_symbol(bytes)`
• Binary symbol. KiB, MiB, GiB, TiB, PiB, EiB, ZiB, YiB, RiB, QiB
• `numeral_binary_symbol(bytes,digits)`
• 四捨五入する小数点以下の桁数が指定できます / Binary symbol with arg for rounding digits.

## 使用例1 / Usage1

``````| makeresults count=35
```THIS SECTION IS JUST CREATING SAMPLE VALUES.```
| streamstats count as digit
| eval val=pow(10,digit-1), val=val+random()%val
| foreach bytes [eval <<FIELD>>=val]
| table digit val bytes
| fieldformat val=tostring(val,"commas")

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 9s",`numeral_binary_symbol(bytes,1)`)
``````

## 使用例2 / Usage2

Example of sorting sourcetypes in descending order of throughput.

``````index="_internal" source="*metrics.log" per_sourcetype_thruput
| stats sum(eval(kb*1024)) AS bytes by series

```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.```
| fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)
| sort 0 - bytes
``````

kbの情報はbytesに変換すれば共通マクロが使えます。
The kb information can be converted to bytes and a common macro can be used.

fieldformatはもとの値を内部で保持するため、MiBやKiBの表示でも値の大小が比較可能でソートが使えます。
Since the fieldformat retains the original value internally, the MiB and KiB displays can also be used for sorting, with the values being comparable.

## なぜ単位がKB, MBでなくKiB, MiBなのか？ / Why weird units KiB, MiB using instead of KB, MB?

As a side note,
in the general public, the definition of “kilo” is 1000 and has no other meaning,
but in the computer world, it has long been a common belief that KB (Killo Byte) is 1024 bytes to the 10th power of 2,
as if it were common knowledge in the industry.

しかしこれはまちがいなく混乱の元なので、`IEC 60027-2`, `IEEE 1541-2002`, `IEC 80000-13:2008` などの規格では、混乱を避けるため1024バイトを基準としたバイトの単位としてKiB(キビバイト)、MiB(メビバイト)という単位が規定されています。

However, this is definitely a source of confusion, so standards such as `IEC 60027-2`, `IEEE 1541-2002`, and `IEC 80000-13:2008` defines the KiB (Kibibyte) and MiB (Mebibyte) units as byte units based on 1024 bytes to avoid confusion.

これらの単位は全然普及していなくて見慣れないものですが、

Splunkの出力で誤解を避けて共通認識を持ってもらえるようにあえてこの単位での表記を採用しました。

These units are not at all widespread and unfamiliar to us,
but since confusion over numbers is a source of misunderstanding,
I dared to use these units in that macros in order to avoid misunderstanding
and to have a common understanding in Splunk’s output.

Enjoy Splunking!

Version2.0では各種単位間の相互換算のマクロが追加されました。
Splunkで様々な単位を換算する

0
1
1

Register as a new user and use Qiita more conveniently

1. You get articles that match your needs
2. You can efficiently read back useful information
3. You can use dark theme
What you can do with signing up
0
1