I'm trying to calculate the data throughput for a cloud computing solution that will be charging based on outgoing data throughput. We're collecting on the link using security onion and forwarding those zeek logs to our splunk instance.  index="zeek" source="conn.log" ((id.orig_h IN `front end`) AND NOT (id.resp_h IN `backend`)) OR ((id.resp_h IN `front end`) AND NOT (id.orig_h IN `backend`)) | fields orig_bytes, resp_bytes | eval terabytes=(((((resp_bytes+orig_bytes)/1024)/1024)/1024)/1024) | stats sum (terabytes) This gives me traffic throughput in and out of the network for external connections however what I need is to calculate orig_bytes only when the id.orig_h is my `frontend` and resp_bytes when id.resp_h is `frontend`. I can get them separately by just doing two different searches and then adding the results up by hand. But I'm sure theres a way to do what I want to in one search using some sort of conditional. I've tried using where and eval if but I'm just not skilled enough it seems.  ... View more