Hello everyone, I am new to Splunk and learning the ropes. I am stuck on a query I am trying setup. I have SNMP data coming in and I am trying to measure traffic in Mbps or Kbps. SNMP uses a continuous bit counter which continuous adding traffic to a total sum. In order to get Mbps I have to use the following calculation: ((Current_Value - Previous Value) / (current_time - previous_time)) and then convert bytes to Mbps. This is working fine, however I want to be able to do this "foreach" interface for a dashboard. Right now when I use a wildcard for interface name it breaks, because the delta calculation doesn't always use the same interface. index=sample name="interfaces" ifName="ethernet1/1" | where bytes_in!=0 | sort _time | delta _time AS time_delta | delta bytes_in AS delta_bytes_in | eval Kbps = (((delta_bytes+in *8 )/1000 / time_delta) | eval Mbps = Kbps/1000 | table _time, Mbps When I switch ifName="ethernet1/1" to  "ifName="*" this breaks. I was hoping to use foreach to iterate over each interface, but do not know how. Was hoping someone could help me with this 🙂 ... View more