hello guys
i am new in splunk world, i want to create a report that show total inbound traffic in Mb. here is my search code :
sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"
and here is my pivot visual with table entry.
hi @scelikok thanks for your answer
i customize our code :
sourcetype=fgt_traffic dest=0.0.0.0 NOT (src=0.0.0.0 OR dest=test.com) bytes_in>0 NOT action ="blocked"
| stats sum(bytes_in) as "Total Traffic Receive" by dstip
| eval "Total Traffic Receive"=round('Total Traffic Receive'/10240/1024,2)
| rename dstip as "DMZ Server"
it's work perfect.
@soheilamiri, changing timechart command to stats should work;
sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"
| stats count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"
If this resolves your issue, an upvote is appreciated.
Sorry @soheilamiri, I wrote without testing, below should work
sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"
| stats count(srcip) as From sum(bytes_in) as "Total Traffic Receive" values(dstport) as Port by dstip
| eval "Total Traffic Receive"=round('Total Traffic Receive'/1024/1024,2)
| rename dstip as"DMZ Server"
hi @scelikok thanks for your answer
i customize our code :
sourcetype=fgt_traffic dest=0.0.0.0 NOT (src=0.0.0.0 OR dest=test.com) bytes_in>0 NOT action ="blocked"
| stats sum(bytes_in) as "Total Traffic Receive" by dstip
| eval "Total Traffic Receive"=round('Total Traffic Receive'/10240/1024,2)
| rename dstip as "DMZ Server"
it's work perfect.
Hi @soheilamiri, please try below;
sourcetype=fgt_traffic dest=1.1.1.* NOT (src=1.1.1.* OR dest=skyroom.online) bytes_in>0 AND action ="allowed"
| timechart count(srcip) as From eval(round(sum(bytes_in)/1024/1024,2)) as "Total Traffic Receive" values(dstport) as Port by dstip | rename dstip as"DMZ Server"