How do you build a search to total the bytes transfered (sending and recieving) by ip address for the last 24 hours, by indexing a cisco firewall?
Have you thought about getting this data via netflow and using the Netflow app on Splunkbase? It will give the details you are looking for I think.
http://splunk-base.splunk.com/apps/22328/splunk-for-netflow
Gotcha, the Netflow app won't work on windows. The Splunk App for Cisco firewall will have the field extractions you are looking for and may already have a view for amount of traffic based on IP. I think it is fine on windows from what I recall.
Running on a windows server. Can I use the data from the cisco firewall?
