My two cents;
Interfaces.sh - Shows stats per link-level Ethernet interface (simply, NIC)
sourcetype=interfaces
Runs an eval ifconfig command and gets mac address, ipv4/6 addres, collisions, RXbytes, Rxerrors, Txbytes, Txerrors, speed and duplex settings.
Bandwith.sh shows Network Utilization, Total Network, cpu statistics
Runs the sar -n command and gets the rxPackets_PS txPackets_PS rxKB_PS txKB_PS
sourcetype=bandwith
I believe that the Nix app mostly uses the interfaces sourcetype and not so much the bandwoth sourcetype.
Best thing you can do is enable it on a test system and research both sourcetypes:
sourcetype=interfaces or sourcetype=bandwith
bandwith.sh explanation is missing from splunkdocs, or I cannot find it.
... View more