I want to calculate the volume of traffic ( FortiGate firewall) ;
I wrote this query I don't know if it's correct or not.
"index=<my index> sourcetype=<my_sourcetype> | eval TotalTraffic_GB = (sum(bytes)/1000000000)| stats sum(TotalTraffic_GB) as TotalGigaBytes ,
avg(TotalTraffic_GB) as AvgGigaBytes, max(TotalTraffic_GB) as MaxGigaBytes"
PLEASE CAN ANY ONE HELP ME ??
Assuming bytes is field containing one or more numerics, the search looks like it will work. How you tried it? Do you get an error?