https://community.splunk.com/t5/Splunk-Search/Charting-bytes/m-p/49960#M12005 <P>Provided that the "byte_in" field is properly extracted, you probably want something like this :</P> <P><CODE>... | timechart sum(byte_in) AS "Incoming bytes"</CODE></P> <P>And if you would like to convert that number to say megabytes, you can pretty much do that in-line with timechart :</P> <P><CODE>... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes"</CODE></P> <P>Finally, it could be nice to throw in the incoming rate of events in kilobytes per second :</P> <P><CODE>... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes" per_second(eval(byte_in/1024)) AS "Incoming throughput (KB/s)"</CODE></P> <P>I recommend that you check the <A href="http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Timechart" target="_blank">entry for timechart</A> in the search reference manual, as well as the page <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions" target="_blank">listing its available functions</A> in detail.</P> <P>If you are very new to the search language, the <A href="http://docs.splunk.com/Documentation/Splunk/4.3/User/WelcometotheSplunkTutorial" target="_blank">Splunk tutorial</A> is a great read.</P> Mon, 28 Sep 2020 10:18:39 GMT hexx 2020-09-28T10:18:39Z https://community.splunk.com/t5/Splunk-Search/Charting-bytes/m-p/49959#M12004 <P>I'm trying to chart the total traffic that is flowing from inside my FW to the outside of my firewall. Here is an excerpt of the log.</P> <P>Jan 11 22:33:15 10.197.210.243 Jan 12 2012 06:39:15: ASA: Teardown TCP connection 145063345275150489 for Inside_405:16.16.16.16/61463 to Outside_304:10.10.10.10/2223 duration 13:22:09 bytes 4081289473 TCP Reset-I</P> <P>I want to know how much traffic is going along port 2223 in this case. I have used | timechart count(byte_in) but that doens't give me the amount of traffic.</P> Mon, 28 Sep 2020 10:18:37 GMT https://community.splunk.com/t5/Splunk-Search/Charting-bytes/m-p/49959#M12004 mlevenson 2020-09-28T10:18:37Z https://community.splunk.com/t5/Splunk-Search/Charting-bytes/m-p/49960#M12005 <P>Provided that the "byte_in" field is properly extracted, you probably want something like this :</P> <P><CODE>... | timechart sum(byte_in) AS "Incoming bytes"</CODE></P> <P>And if you would like to convert that number to say megabytes, you can pretty much do that in-line with timechart :</P> <P><CODE>... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes"</CODE></P> <P>Finally, it could be nice to throw in the incoming rate of events in kilobytes per second :</P> <P><CODE>... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes" per_second(eval(byte_in/1024)) AS "Incoming throughput (KB/s)"</CODE></P> <P>I recommend that you check the <A href="http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Timechart" target="_blank">entry for timechart</A> in the search reference manual, as well as the page <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions" target="_blank">listing its available functions</A> in detail.</P> <P>If you are very new to the search language, the <A href="http://docs.splunk.com/Documentation/Splunk/4.3/User/WelcometotheSplunkTutorial" target="_blank">Splunk tutorial</A> is a great read.</P> Mon, 28 Sep 2020 10:18:39 GMT https://community.splunk.com/t5/Splunk-Search/Charting-bytes/m-p/49960#M12005 hexx 2020-09-28T10:18:39Z