topic Re: Network logs - Join bytes base on unique ip over time in Getting Data In

Network logs - Join bytes base on unique ip over time

totaro — Fri, 05 Apr 2019 01:20:15 GMT

Hi,

Im trying to generate a table that consolidate the bytes base on unique IP in a day with netflow logs.
In short, im trying to generate a report for the bandwidth used by each of the unique ip
Any help will be appreciated!
e.g.
Date UniqueIP Bytes
1-1-2019 1.2.3.4 500
1-1-2019 2.3.4.5 600
1-1-2019 3.4.5.6 700
Date UniqueIP Bytes
2-1-2019 11.2.3.4 500
2-1-2019 21.3.4.5 600
2-1-2019 31.4.5.6 700

Re: Network logs - Join bytes base on unique ip over time

vnravikumar — Fri, 05 Apr 2019 02:06:24 GMT

Give a try

your query..| eval Date=strftime(_time,"%d-%m-%Y") 
| stats sum(Bytes) as Bytes by Date,UniqueIP

Re: Network logs - Join bytes base on unique ip over time

totaro — Fri, 05 Apr 2019 02:10:37 GMT

thanks! it work