Getting Data In

Visualize netflow in splunk

nickbijmoer
Path Finder

Hello guys I get network traffic logs in splunk the structure is:

2016-11-24 10:59:50,2016-11-24 10:59:50,0.000,xxx.xx.xx.4,xx.xx.xxx.xx3,65499,389,UDP,......,0,0,0,0,0,0,13,17,0,0,0,0,0,0,0.0.0.0,0.0.0.0,0,0,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0, 0.000, 0.000, 0.000,xxx.xx.xx.x7,0/0,1,2016-11-24 10:59:50.402

How can I visualize how much traffic we have everyday?

0 Karma
1 Solution

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip

View solution in original post

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...