topic Re: how convert byte to Mb in Dashboards & Visualizations

how convert byte to Mb

soheilamiri — Sun, 20 Dec 2020 11:57:45 GMT

hello guys

i am new in splunk world, i want to create a report that show total inbound traffic in Mb. here is my search code :

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"

and here is my pivot visual with table entry.

Re: how convert byte to Mb

scelikok — Sun, 20 Dec 2020 12:20:52 GMT

Hi @soheilamiri, please try below;

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" | timechart count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"

Re: how convert byte to Mb

soheilamiri — Sun, 20 Dec 2020 13:45:40 GMT

Hi @scelikok

thanks for reply. the output of suggested script is not what i aspect.

here is IMAGE that show more details. the X axis should be dest and the Y axis should be Bytes_in in Mb.

how can i create this chart with my specific visual.

Re: how convert byte to Mb

scelikok — Sun, 20 Dec 2020 14:02:19 GMT

@soheilamiri, changing timechart command to stats should work;

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" | stats count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"

If this resolves your issue, an upvote is appreciated.

Re: how convert byte to Mb

soheilamiri — Sun, 20 Dec 2020 14:10:11 GMT

hi @scelikok

i get this error :

Error in 'stats' command: The argument 'eval(round(sum(bytes_in)/1024/1024,2))' is invalid.

Re: how convert byte to Mb

scelikok — Sun, 20 Dec 2020 20:59:47 GMT

Sorry @soheilamiri, I wrote without testing, below should work

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" | stats count(srcip) as From sum(bytes_in) as "Total Traffic Receive" values(dstport) as Port by dstip | eval "Total Traffic Receive"=round('Total Traffic Receive'/1024/1024,2) | rename dstip as"DMZ Server"

Re: how convert byte to Mb

soheilamiri — Mon, 21 Dec 2020 10:43:45 GMT

hi @scelikok thanks for your answer

i customize our code :

sourcetype=fgt_traffic dest=0.0.0.0 NOT (src=0.0.0.0 OR dest=test.com) bytes_in>0 NOT action ="blocked" | stats sum(bytes_in) as "Total Traffic Receive" by dstip | eval "Total Traffic Receive"=round('Total Traffic Receive'/10240/1024,2) | rename dstip as "DMZ Server"

it's work perfect.