topic Re: show send and receive from internet to my ftp server in Splunk Search

show send and receive from internet to my ftp server

khanlarloo — Tue, 29 Sep 2020 23:13:21 GMT

i want to show the how much user send and receive from the internet to my ftp server,is my search command right?
index="fw" policyid=143 |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) |search send > 0 |timechart span=1m count by send receive
it shows the count of the send but i don't want to show send based on count

Re: show send and receive from internet to my ftp server

DMohn — Wed, 13 Feb 2019 10:31:31 GMT

You are using the count command here, hence it is showing you counts. If you want to have the sum of the transferred data, use sum instead...

index="fw" policyid=143 |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) |search send > 0 |timechart span=1m sum(send) as sent, sum(receive) as received

Re: show send and receive from internet to my ftp server

khanlarloo — Sat, 16 Feb 2019 07:54:44 GMT

it doesn't show the correct bandwidth

Re: show send and receive from internet to my ftp server

DMohn — Sat, 16 Feb 2019 08:30:43 GMT

Can you post some example log lines, this would make it easier to help...

Re: show send and receive from internet to my ftp server

woodcock — Sat, 16 Feb 2019 23:43:44 GMT

Try this:

index="fw" policyid=143
| timechart span=1m sum(bytes_out) AS sent sum(bytes_in) AS received BY user
| foreach sent* received* [ eval <<FIELD>> = round('<<FIELD>>'/131072, 2) ]
|eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2)