How to calculate GB/day

[HemantKumar1]

How do we calculate GB/day for Log and packets. Its SA version 10.6.0.

Is there a script or report that can be run to get this?

[ThomasFedorchuk]

This can be accomplished with a Report. Start by creating a Report Rule. Build the rule using the NetWitness DB. Give the rule a name, summarize the rule by "Session Size". Use "device.type" in the select statement. Group by "device.type". Test the rule, then use the rule in a report. Example rule and rule output are shown below.

[RenatoGoncalves]

Hello 

Is it possible to change the total sessions data in the pdf? Has we see in the picures it appears im MB but after i created a report with the rule it appears in bytes...

Also is there a way to create a graphic or a table with only the totals?

Thomas Fedorchuk‌

[GuyBruneau]

Renato,

I do a similar daily report but for the select I used did for Decoder. The report will display the amount of data based on what it has (bytes, MB, GB...) I'm not sure it is possible to display a report without the meta type.

[RenatoGoncalves]

Hello Guy,

I will test it for sure

[AgustinGras]

If you need, an avarage only the total of GB per day without detailing the type of devices. You can do the same report but using on the select clause "medium", and on the where clause "medium = 32" (in logs case). In this way you are watching a total of gb in a time specified and you could do an avarage per day with that data.

I hope you find it useful.

[RenatoGoncalves]

Thanks Agustin...

I´ll try it.