Splunk Search

Charting bytes

mlevenson
Explorer

I'm trying to chart the total traffic that is flowing from inside my FW to the outside of my firewall. Here is an excerpt of the log.

Jan 11 22:33:15 10.197.210.243 Jan 12 2012 06:39:15: ASA: Teardown TCP connection 145063345275150489 for Inside_405:16.16.16.16/61463 to Outside_304:10.10.10.10/2223 duration 13:22:09 bytes 4081289473 TCP Reset-I

I want to know how much traffic is going along port 2223 in this case. I have used | timechart count(byte_in) but that doens't give me the amount of traffic.

Tags (3)

hexx
Splunk Employee
Splunk Employee

Provided that the "byte_in" field is properly extracted, you probably want something like this :

... | timechart sum(byte_in) AS "Incoming bytes"

And if you would like to convert that number to say megabytes, you can pretty much do that in-line with timechart :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes"

Finally, it could be nice to throw in the incoming rate of events in kilobytes per second :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes" per_second(eval(byte_in/1024)) AS "Incoming throughput (KB/s)"

I recommend that you check the entry for timechart in the search reference manual, as well as the page listing its available functions in detail.

If you are very new to the search language, the Splunk tutorial is a great read.

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...