how convert byte to Mb

[soheilamiri]

hello guys

i am new in splunk world, i want to create a report that show total inbound traffic in Mb. here is my search code : 

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"

and here is my pivot visual with table entry.

 

[scelikok]

@soheilamiri, changing timechart command to stats should work;

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" 
| stats count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"

If this resolves your issue, an upvote is appreciated.

[soheilamiri]

hi @scelikok 

i get this error : 

Error in 'stats' command: The argument 'eval(round(sum(bytes_in)/1024/1024,2))' is invalid.

[scelikok]

Sorry @soheilamiri, I wrote without testing, below should work

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" 
| stats count(srcip) as From sum(bytes_in) as "Total Traffic Receive" values(dstport) as Port by dstip 
| eval "Total Traffic Receive"=round('Total Traffic Receive'/1024/1024,2)
| rename dstip as"DMZ Server"

[soheilamiri · Accepted solution]

hi @scelikok thanks for your answer

i customize our code : 

sourcetype=fgt_traffic dest=0.0.0.0 NOT (src=0.0.0.0 OR dest=test.com) bytes_in>0 NOT action ="blocked" 
| stats  sum(bytes_in) as "Total Traffic Receive" by dstip
| eval "Total Traffic Receive"=round('Total Traffic Receive'/10240/1024,2)
| rename dstip as "DMZ Server"

 it's work perfect.

[scelikok]

Hi @soheilamiri, please try below;

sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed" 
| timechart count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"

[soheilamiri]

Hi @scelikok 

thanks for reply. the output of suggested script is not what i aspect.

here is IMAGE  that show more details. the X axis should be dest and the Y axis should be Bytes_in in Mb.

how can i create this chart with my specific visual.