Getting Data In
Highlighted

Cisco Firewall Total bytes by ip address last 24 hours

Engager

How do you build a search to total the bytes transfered (sending and recieving) by ip address for the last 24 hours, by indexing a cisco firewall?

Tags (4)
0 Karma
Highlighted

Re: Cisco Firewall Total bytes by ip address last 24 hours

Splunk Employee
Splunk Employee

Have you thought about getting this data via netflow and using the Netflow app on Splunkbase? It will give the details you are looking for I think.

http://splunk-base.splunk.com/apps/22328/splunk-for-netflow

0 Karma
Highlighted

Re: Cisco Firewall Total bytes by ip address last 24 hours

Engager

Running on a windows server. Can I use the data from the cisco firewall?

0 Karma
Highlighted

Re: Cisco Firewall Total bytes by ip address last 24 hours

Splunk Employee
Splunk Employee

Gotcha, the Netflow app won't work on windows. The Splunk App for Cisco firewall will have the field extractions you are looking for and may already have a view for amount of traffic based on IP. I think it is fine on windows from what I recall.

0 Karma