EPS Count per Event source group of devices

[TomaNikolov]

If we have lots of devices, differentiated in separate Event groups, can we see a report of the EPS per event group?
The events will be collected via VLCs. 

[ThomasFedorchuk · Accepted solution]

Hi,

Not sure you can get a granular as events per second, but perhaps this type of report rule might be useful.

Use the meta lc.cid to list your VLCs.

This rule will produce output similar to the following...

[TomaNikolov]

Greetings Thomas, 

Thank you for the suggestion. 
You show this example on Netwitness 10.6  - what about Netwitness 11.0, is there any difference? 

Thank you in advance! 

[MihaMesojedec]

There is no different in NW 11 reporting capabilities for your use case.

Thanks,

Miha

[SureshThanikach]

Hi Thomas,

Thanks for this artical, we managed to build a report for fetching the EPS count in (decoder/VLC),

but it will be really helpful if you can suggest us on how to fetch the average figures daily/hourly (like it shows in database / stats under session rate) for the EPS (Log/Packet) Decoder.

Now we are only getting the total number of events on the decoder/VLC and the total number of events on the device .type, but we need to identify  the average stats for daily/hourly (like it shows in database / stats under session rate)

[RenatoGoncalves]

Thats also something i would like to know....

[RenatoGoncalves]

Anyone know if its possible to add a column with the second eps and not a minute, hour or day data? Just to make it simple, because in this form we need to do a lot of math