i want to show the how much user send and receive from the internet to my ftp server,is my search command right?
index="fw" policyid=143 |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) |search send > 0 |timechart span=1m count by send receive
it shows the count of the send but i don't want to show send based on count
Try this:
index="fw" policyid=143
| timechart span=1m sum(bytes_out) AS sent sum(bytes_in) AS received BY user
| foreach sent* received* [ eval <<FIELD>> = round('<<FIELD>>'/131072, 2) ]
|eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2)
You are using the count
command here, hence it is showing you counts. If you want to have the sum of the transferred data, use sum
instead...
index="fw" policyid=143 |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) |search send > 0 |timechart span=1m sum(send) as sent, sum(receive) as received
it doesn't show the correct bandwidth
Can you post some example log lines, this would make it easier to help...