So, looking at NAT I can select an IP Address Group that includes the hosts on our WiSP network - all of this traffic passes through a single monitored interface. So, I can change the resource to look at total usage for all WiSP hosts. It's pretty easy to get this resource up and change for time frame to get a good look at things. The only thing I wish is that I could filter to endpoints that have more than, say, 20 GB of traffic for the month (some months we have 20, some months we have 50, and it's a pain to change the resource to show the top 30 or 50 and refresh the whole page. So, I would like to build a report to generate this exact resource, but filter to those endpoints over 20 GB total.
My view in Orion looks like this:
Now, I am having some trouble getting my report to work out. I took the default Top 5 Traffic Sources by IP Address Group - Last 24 Hours and modified it for this. The point I am at has my config like this:
I have the Bytes Total unchecked because it was causing me issues (results showed did not make sense).
Anyway, the current config show different numbers than the resource shows up on the web pages (ie. x.x.125.105 shows 197.7 GB in the resource and 177.4 GB in this report). So, is there an easier way to get this resource into a report and do some filtering? It's not an issue of Ingress vs. Egress vs Both, I have checked that. I'm also not sure why the Total Bytes filter entry does what it does - endpoints with 4 GB and under show up then. Unless I don't understand that entry?
Any help is appreciated. Thanks in advance.