Getting Data In

How to calculate traffic overview?

RJ2
Observer

I want to calculate the volume of traffic ( FortiGate firewall) ;

 

I wrote this query I don't know if it's correct or not.

"index=<my index> sourcetype=<my_sourcetype>  | eval TotalTraffic_GB = (sum(bytes)/1000000000)| stats sum(TotalTraffic_GB) as TotalGigaBytes ,
avg(TotalTraffic_GB) as AvgGigaBytes, max(TotalTraffic_GB) as MaxGigaBytes"

PLEASE CAN ANY ONE HELP ME ?? 

Labels (5)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming bytes is field containing one or more numerics, the search looks like it will work. How you tried it? Do you get an error?

0 Karma

RJ2
Observer

It works well ! without any error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...