Getting Data In

Visualize netflow in splunk

nickbijmoer
Path Finder

Hello guys I get network traffic logs in splunk the structure is:

2016-11-24 10:59:50,2016-11-24 10:59:50,0.000,xxx.xx.xx.4,xx.xx.xxx.xx3,65499,389,UDP,......,0,0,0,0,0,0,13,17,0,0,0,0,0,0,0.0.0.0,0.0.0.0,0,0,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0, 0.000, 0.000, 0.000,xxx.xx.xx.x7,0/0,1,2016-11-24 10:59:50.402

How can I visualize how much traffic we have everyday?

0 Karma
1 Solution

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip

View solution in original post

kalianov
Path Finder
  1. Extract field with data size per session, for example "trafic_size"
  2. Extract other fields (ip, port, e.t.c.)
  3. Select the time period for which you want to count traffic
  4. Calculate your traffic:
    your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...