Hi,
I have a network rate graph i build from my firewall logs with the timechart command:
host=firewall_IP type=traffic | timechart sum(rcvdbyte)
It works fine, except with very long sessions: because the firewall log is not packet-based but session-based, so for those sessions i only have a huge peak at the time of the session end, instead of a continuous line from the start to the end of the session.
Is there a way to draw a chart which show a continuous rate between the session start and the end ?
The messages (events) contain : session start time, session end time, session ID (unique), duration of session (in end message), cumulative bytes (in end message).
thanks
... View more