# Timelion snmp interface traffic query

**URL:** <https://discuss.elastic.co/t/timelion-snmp-interface-traffic-query/236789>\
**Category:** Kibana\
**Tags:** timelion\
**Created:** [June 11, 2020, 9:52pm UTC](https://discuss.elastic.co/t/timelion-snmp-interface-traffic-query/236789 "2020-06-11T21:52:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kbrown](https://avatars.discourse-cdn.com/v4/letter/k/f475e1/32.png) [@kbrown](https://discuss.elastic.co/u/kbrown)\
**Post date:** [June 11, 2020, 9:52pm UTC](https://discuss.elastic.co/t/timelion-snmp-interface-traffic-query/236789/1 "2020-06-11T21:52:44Z")

</div>

Hi,

I'm trying to fix a timelion query for interface traffic via snmp with ifHCInOctets and ifHCOutOctets.

I've tried it in a few ways, trying to follow examples from this forum and also from [https://berrynetworks.wordpress.com/2019/08/30/juniper-srx-performance-monitoring-with-the-elastic-stack/](https://berrynetworks.wordpress.com/2019/08/30/juniper-srx-performance-monitoring-with-the-elastic-stack/)

#1 -  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).divide(8).mvavg(30s).yaxis(units=bits/s,max=100000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/8/78f713cff48443e7875519d23635153300ff01f1.png)

#2 -  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).subtract(.es(index=dc1snmp\*, metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2, offset=-30s).multiply(8).mvavg(30s).yaxis(units=bits/s,max=10000000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s))

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6fbcdb5b11fe6b16784a22d75c914147f6c73580.png)

With either instance, I seem to be having an issue with it subtracting the last polling sum with the current value.

I'm kind of surprised because this is a common query and I can't seem to find many examples online of people having it working.

If anyone can take a look and offer suggestions, it would be much appreciated.

Thank you!

update - I think this is the closest I've gotten (using derivative), but I'm not sure why I'm getting negative values.  
I've had to divide by 8, it seems like multiplying by 8 for octets -\> bits is giving me inaccurate numbers  
#3  
.es(index=dc1snmp\*,metric=sum:iso.org.dod.internet.mgmt.mib-2.ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifHCInOctets.2).divide(8).mvavg(30s).yaxis(units=bits/s,max=100000000).label("Ingress x2 WAN").lines(fill=1,width=2).scale\_interval(1s).derivative()

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/7/d7bab6bcf2a26a672d655c780643a77f49147155.png)

---

<div class="post-metadata">

**Author:** ![kbrown](https://avatars.discourse-cdn.com/v4/letter/k/f475e1/32.png) [@kbrown](https://discuss.elastic.co/u/kbrown)\
**Post date:** [June 12, 2020, 2:49pm UTC](https://discuss.elastic.co/t/timelion-snmp-interface-traffic-query/236789/2 "2020-06-12T14:49:49Z")

</div>

@timroes , I saw a post of yours related to this - [Graphing Network utilisation from SNMP ifHCInOctets](https://discuss.elastic.co/t/graphing-network-utilisation-from-snmp-ifhcinoctets/164628)

I was hoping I could grab your attention and see if there is anything obviously wrong with how I am trying to achieve this.

Thanks in advance : )

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2020, 2:50pm UTC](https://discuss.elastic.co/t/timelion-snmp-interface-traffic-query/236789/3 "2020-07-10T14:50:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.