Getting Data In

How to calculate traffic overview?

RJ2
Observer

I want to calculate the volume of traffic ( FortiGate firewall) ;

 

I wrote this query I don't know if it's correct or not.

"index=<my index> sourcetype=<my_sourcetype>  | eval TotalTraffic_GB = (sum(bytes)/1000000000)| stats sum(TotalTraffic_GB) as TotalGigaBytes ,
avg(TotalTraffic_GB) as AvgGigaBytes, max(TotalTraffic_GB) as MaxGigaBytes"

PLEASE CAN ANY ONE HELP ME ?? 

Labels (5)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming bytes is field containing one or more numerics, the search looks like it will work. How you tried it? Do you get an error?

0 Karma

RJ2
Observer

It works well ! without any error

Tags (1)
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...