Splunk Search

Charting bytes

mlevenson
Explorer

I'm trying to chart the total traffic that is flowing from inside my FW to the outside of my firewall. Here is an excerpt of the log.

Jan 11 22:33:15 10.197.210.243 Jan 12 2012 06:39:15: ASA: Teardown TCP connection 145063345275150489 for Inside_405:16.16.16.16/61463 to Outside_304:10.10.10.10/2223 duration 13:22:09 bytes 4081289473 TCP Reset-I

I want to know how much traffic is going along port 2223 in this case. I have used | timechart count(byte_in) but that doens't give me the amount of traffic.

Tags (3)

hexx
Splunk Employee
Splunk Employee

Provided that the "byte_in" field is properly extracted, you probably want something like this :

... | timechart sum(byte_in) AS "Incoming bytes"

And if you would like to convert that number to say megabytes, you can pretty much do that in-line with timechart :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes"

Finally, it could be nice to throw in the incoming rate of events in kilobytes per second :

... | timechart sum(eval(byte_in/1024/1024)) AS "Incoming Megabytes" per_second(eval(byte_in/1024)) AS "Incoming throughput (KB/s)"

I recommend that you check the entry for timechart in the search reference manual, as well as the page listing its available functions in detail.

If you are very new to the search language, the Splunk tutorial is a great read.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...