Hi, bit new to splunk, looking for suggestions on one of my search queries:
Here's some sample events that I receive
{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 10000,
"connection.created" : 1603614820
}
{
"inbound.network.service": "192.168.1.20, 50700",
"inbound.bytes.count": 40000,
"connection.created" : 1603555900
}
{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 10200,
"connection.created" : 1603614820
}
{
"inbound.network.service": "192.168.1.20, 50700",
"inbound.bytes.count": 43000,
"connection.created" : 1603555900
}
{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 500,
"connection.created" : 1603679500
}
Details about individual fields:
- the "inbound.network.service" field has the endpoint for each connection in my server
- "inbound.bytes.count" will have the cummulative inbound bytes count for a particular inbound connection. This count gets resetted once the connection gets reset.
- "connection.created" has the timestamp when the connection got created. The timestamp value remains the same as long as the connection is valid. It gets resetted to a new timestamp once the connection is re-established. The "inbound.bytes.count" also gets re-initialized when that happens.
Here's my existing search query to list bytes received for a particular inbound network & service:
index=inettraffic source="my-server" inbound.network.service="192.168.1.7, 50990"
| reverse
| delta connection.created as connection_reset
| delta inbound.bytes.count as bytes_diff
| eval bytes_received = case(connection_reset == 0, bytes_diff, connection_reset > 0, 'inbound.bytes.count', true(), 0)
| table _time, inbound.network.service, connection.created, connection_reset, inbound.bytes.count, bytes_diff, bytes_received
Questions:
(1) Is there a better how this can be done ?
(2) I am looking to get a similar tabular listing of bytes received over _time for all inbound network & services that I have in my events so far. How do I do this ? With delta, it ends up taking a difference of the previous event which may not be for the same inbound.network.service.
Appreciate all your help here, thanks.
