Getting Data In

Visualize netflow in splunk

nickbijmoer
Path Finder

Hello guys I get network traffic logs in splunk the structure is:

2016-11-24 10:59:50,2016-11-24 10:59:50,0.000,xxx.xx.xx.4,xx.xx.xxx.xx3,65499,389,UDP,......,0,0,0,0,0,0,13,17,0,0,0,0,0,0,0.0.0.0,0.0.0.0,0,0,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0, 0.000, 0.000, 0.000,xxx.xx.xx.x7,0/0,1,2016-11-24 10:59:50.402

How can I visualize how much traffic we have everyday?

0 Karma
1 Solution

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip

View solution in original post

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...