How to graph the rate from firewall logs with only start and end session messages ?

[efourage]

Hi,

I have a network rate graph i build from my firewall logs with the timechart command:

host=firewall_IP type=traffic | timechart sum(rcvdbyte)

It works fine, except with very long sessions: because the firewall log is not packet-based but session-based, so for those sessions i only have a huge peak at the time of the session end, instead of a continuous line from the start to the end of the session.

Is there a way to draw a chart which show a continuous rate between the session start and the end ?

The messages (events) contain : session start time, session end time, session ID (unique), duration of session (in end message), cumulative bytes (in end message).

thanks

[splk]

Bump, have the same question.

We try to chart bytes over duration for a dedicated start time.
So the bytes have to be uniformley distributed in a time chart from start time + duration (as end time).