Visualize netflow in splunk

[nickbijmoer]

Hello guys I get network traffic logs in splunk the structure is:

2016-11-24 10:59:50,2016-11-24 10:59:50,0.000,xxx.xx.xx.4,xx.xx.xxx.xx3,65499,389,UDP,......,0,0,0,0,0,0,13,17,0,0,0,0,0,0,0.0.0.0,0.0.0.0,0,0,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,00:00:00:00:00:00,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0,0-0-0, 0.000, 0.000, 0.000,xxx.xx.xx.x7,0/0,1,2016-11-24 10:59:50.402

How can I visualize how much traffic we have everyday?

[kalianov · Accepted solution]

1. Extract field with data size per session, for example "trafic_size"
2. Extract other fields (ip, port, e.t.c.)
3. Select the time period for which you want to count traffic
4. Calculate your traffic:
   your search | stats sum (trafic_size) OR calculate your traffic by ip: your search | stats sum (trafic_size) by ip