How to find total byte count?

[DEAD_BEEF]

I am looking through my firewall logs and would like to find the total byte count between a single source and a single destination. There are multiple byte count values over the 2-hour search duration and I would simply like to see a table listing the source, destination, and total byte count.

I've tried stats and eventstats but nothing seems to work right.

Current query:

index=fw_log src_ip=1.2.3.4 dst_ip=5.6.7.8 | eventstats sum(bytes) AS "Total Bytes" by src_ip | table src_ip,dst_ip,"Total Bytes"

What I want is:

    src_ip     dst_ip   Total Bytes
    1.2.3.4    5.6.7.8  94782161

What I'm getting is:

    src_ip     dst_ip   Total Bytes
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882
    1.2.3.4    5.6.7.8  37473882

[sideview · Accepted solution]

index=fw_log src_ip=1.2.3.4 dst_ip=5.6.7.8 | stats sum(bytes) AS "Total Bytes" by src_ip dst_ip

That will give you the one row. You don't want to use eventstats here, but rather its bigger brother stats. Stats with a "by foo" or "by foo bar", will output one row for every unique combination of the "by" fields. Eventstats however, will output pretty much exactly the same rows that it received from the prior command, except that it will have tacked on a couple extra fields that it computed in various ways.

If you want to see all pairs of src_ip and dst_ip, that would be

index=fw_log  | stats sum(bytes) AS "Total Bytes" by src_ip dst_ip

[DEAD_BEEF]

Not sure how I missed this, thank you!

[velthias]

How do you convert the Total Bytes into mb or gb from this search?

[to4kawa]

index=fw_log  
| stats sum(bytes) AS Total_Bytes
sum(eval(round(bytes/1024))) AS Total_Bytes_MB
sum(eval(round(bytes/1024/1024))) AS "otal_Bytes_GB by src_ip dst_ip

OR

 index=fw_log  
| stats sum(bytes) AS Total_Bytes by src_ip dst_ip
| eval Total_Bytes_MB= round(Total_Bytes/1024)
| eval Total_Bytes_GB=round(Total_Bytes/1024/1024)