Actually I have just noticed a problem. nfdump is only using the second source specified by -R I tried using -M in case that would be better but it did not work either, again only the second source is processed.
nfdump -M profiles/live/source1/2007/02/25/:source2/2007/02/25/ -R . -s record/bytes -n 50 -A srcas -o "fmt:%sas %byt" "in if 17 or in if 12 or in if 2" Is this expected behaviour? Colin Colin Whittaker wrote: > I have two sources of netflow data each with multiple interfaces > generating netflow data. > I want to use a filter to identify which interfaces contain interesting > traffic. In this case interface 17 and 12 for source1 and interface 2 > for source2. At the minute the interface numbers are not overlapping and > so one filter rule works. > But as I increase the number of sources I expect this not to work any > more so I want to be able to identify the source in the filter if possible. > > currently running snapshot-20060809 > > nfdump -R profiles/live/source1/2007/02/25/ -R > profiles/live/source2/2007/02/25/ -s record/bytes -n 50 -A srcas -o > "fmt:%sas %byt" "in if 17 or in if 12 or in if 2" > > Colin -- Colin Whittaker +353 (0)86 836 4509 http://www.magnet.ie [EMAIL PROTECTED] ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
