Need values that arn't included in aggregates auto format. #596
Closed
SandorGardil
started this conversation in
nfdump-1.7
Replies: 1 comment
-
Moved to issue #597 - fixed in master repo. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Is there a way to include certain format values that aren't included in the autoformat from aggregates? I'm running into an issue where for upgrading my nfdump that I have one nfdump query that I'm having issues receiving all of the same values that I was with a 1.6.22 version of nfdump. The values I'm missing from in the new version are the end time and pps. I also noticed that my flows column is all showing only 1 on my 1.7.5 nfdump query where the values for the flows column varied in the 1.6.22 version.
The old command would only allow
dstip
,scrip
,srcport
, anddstport
for aggregates and had the format flag as'fmt:{"protocol": "%pr", "start": "%ts", "end": "%te", "duration": "%td", "srcip": "%sa", "dstip": "%da", "srcport": "%sp", "dstport": "%dp", "srcas": "%sas", "dstas": "%das", "packets": %pkt, "bytes": %byt, "flows": %fl, "packets": %pkt, "tos": %tos, "bps": %bps, "pps": %pps, "Bpp": %bpp}'
.I will note that the old code is not perfect by any means and I found issues where inputs in the old format were pointless as they would never be able to be populated with data with the restrictions the app had on the aggregate fields.
The new command I'm running the command with these for my aggregates
srcip,dstip,srcport,dstport,srcas,dstas,tos,proto
.I didn't see any aggregates that stood out to me that would include the end time or the packets per second in the automated format. Am I missing something that would include these fields in the data?
An example of a full command that I'm running is:
nfdump -M '{path to flows}' -R . -t '2025/01/27.11:18:20-2025/01/28.11:18:19' -N -a -A 'srcip,dstip,srcport,dstport,srcas,dstas,tos,proto' 'src ip 10.25.2.10 or src ip 192.168.0.72 or src ip 192.168.1.83 or dst ip 192.168.1.83'
Thank you for any help.
Beta Was this translation helpful? Give feedback.
All reactions