Charting bytes

[mlevenson]

I'm trying to chart the total traffic that is flowing from inside my FW to the outside of my firewall. Here is an excerpt of the log.

Jan 11 22:33:15 10.197.210.243 Jan 12 2012 06:39:15: ASA: Teardown TCP connection 145063345275150489 for Inside_405:16.16.16.16/61463 to Outside_304:10.10.10.10/2223 duration 13:22:09 bytes 4081289473 TCP Reset-I

I want to know how much traffic is going along port 2223 in this case. I have used | timechart count(byte_in) but that doens't give me the amount of traffic.

[hexx]

Provided that the "byte_in" field is properly extracted, you probably want something like this :

... | timechart sum(byte_in) AS "Incoming bytes"

And if you would like to convert that number to say megabytes, you can pretty much do that in-line with timechart :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes"

Finally, it could be nice to throw in the incoming rate of events in kilobytes per second :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes" per_second(eval(byte_in/1024)) AS "Incoming throughput (KB/s)"

I recommend that you check the entry for timechart in the search reference manual, as well as the page listing its available functions in detail.

If you are very new to the search language, the Splunk tutorial is a great read.