topic Re: Splunking bandwidth from GTA firewalls in Monitoring Splunk

Splunking bandwidth from GTA firewalls

FiveRiversIT — Mon, 28 Sep 2020 11:32:00 GMT

Hello. I'm completely new to splunking and a novice with this firewall.

I'm pretty much trying to monitor bandwidth from a device in my network. I want a nice dashboard to show me this.

So the search that i am using is basically starts like

dstname=10.1.11.103 OR src=10.1.11.103

But not sure what goes next. I'm super clueless and i apologize for this thanks.

Here is a log entry, ip's ommited:

Mar 16 14:36:09 10.1.11.1 Mar 16 14:36:09 id=firewall time="2012-03-16 18:36:09" fw="00000000" pri=5 msg="Accept inbound, NAT tunnel" cat_action=pass dstname=10.1.11.103 proto=https/tcp src=10.1.11.102 srcport=4023 nat=208.x.x.134 natport=443 dnat=10.1.11.1 dnatport=4023 dst=10.1.11.103 dstport=443 rule=3 duration=134 sent=1531 rcvd=12945 pkts_sent=11 pkts_rcvd=14

Re: Splunking bandwidth from GTA firewalls

FiveRiversIT — Fri, 16 Mar 2012 18:58:13 GMT

I'm wondering if this syntax is correct:

dstname=10.1.11.103 OR src=10.1.11.103 | timechart sum(rcvd)

Re: Splunking bandwidth from GTA firewalls

gkanapathy — Fri, 16 Mar 2012 19:14:56 GMT

yes, that is exactly right. you can also do: ... | timechart sum(rcvd), sum(sent).

Re: Splunking bandwidth from GTA firewalls

lguinn2 — Fri, 16 Mar 2012 21:39:51 GMT

or even

dstname=10.1.11.103 OR src=10.1.11.103 |
eval tbytes= rcvd + sent |
timechart sum(tbytes)