topic Re: Cisco Firewall Total bytes by ip address last 24 hours in Getting Data In

Cisco Firewall Total bytes by ip address last 24 hours

rpetrini — Tue, 03 Jul 2012 15:18:19 GMT

How do you build a search to total the bytes transfered (sending and recieving) by ip address for the last 24 hours, by indexing a cisco firewall?

Re: Cisco Firewall Total bytes by ip address last 24 hours

sdaniels — Tue, 03 Jul 2012 16:51:14 GMT

Have you thought about getting this data via netflow and using the Netflow app on Splunkbase? It will give the details you are looking for I think.

http://splunk-base.splunk.com/apps/22328/splunk-for-netflow

Re: Cisco Firewall Total bytes by ip address last 24 hours

rpetrini — Tue, 03 Jul 2012 17:28:09 GMT

Running on a windows server. Can I use the data from the cisco firewall?

Re: Cisco Firewall Total bytes by ip address last 24 hours

sdaniels — Tue, 03 Jul 2012 17:35:55 GMT

Gotcha, the Netflow app won't work on windows. The Splunk App for Cisco firewall will have the field extractions you are looking for and may already have a view for amount of traffic based on IP. I think it is fine on windows from what I recall.