Bandwidth Usage per Interface looks wrong

[Frosty]

I' ve customised a data query found on a blog to produce a Dataset for bandwidth utilisation per Interface. But the numbers I am getting out of it look wrong to me. So either my query is at fault, or perhaps what I think is getting logged actually isn' t! Hoping someone here can either point out what' s wrong with this query, or else confirm that the query looks right and the problem is in the data itself. --------------- query select (CASE `srcintf` WHEN ' port1' THEN ' Port 01 Unused' WHEN ' port2' THEN ' Port 02 Unused' WHEN ' port3' THEN ' Port 03 Unused' WHEN ' port4' THEN ' Port 04 Unused' WHEN ' port5' THEN ' Port 05 Unused' WHEN ' port6' THEN ' Port 06 Unused' WHEN ' port7' THEN ' Port 07 STUDIO' WHEN ' port8' THEN ' Port 08 Unused' WHEN ' port9' THEN ' Port 09 WIRELESS' WHEN ' port10' THEN ' Port 10 PAYMENTS' WHEN ' port11' THEN ' Port 11 Unused' WHEN ' port12' THEN ' Port 12 Unused' WHEN ' port13' THEN ' Port 13 DMZ' WHEN ' port14' THEN ' Port 14 MANAGEMENT' WHEN ' port15' THEN ' Port 15 LAN' WHEN ' port16' THEN ' Port 16 INTERNET' ELSE `srcintf` END) AS src_intf, sum(coalesce(`rcvdbyte`,0)) as total_recvd_bytes, sum(coalesce(`sentbyte`,0)) as total_sent_bytes, sum(coalesce(`rcvdbyte`,0)+coalesce(`sentbyte`,0)) as total_bytes from $log where $filter group by src_intf order by src_intf

[Frosty]

Ah, silly me, I worked it out. The figures are correct. The way I was grouping the data was my problem. The objective was to understand how much traffic was coming through on our Internet link, but broken down into per-interface numbers. So I have rewritten the query as follows, and this is producing numbers that make more sense (same data, just presented differently): ----------- updated query select (CASE `srcintf` WHEN ' port1' THEN ' Port 01 Unused' WHEN ' port2' THEN ' Port 02 Unused' WHEN ' port3' THEN ' Port 03 Unused' WHEN ' port4' THEN ' Port 04 Unused' WHEN ' port5' THEN ' Port 05 Unused' WHEN ' port6' THEN ' Port 06 Unused' WHEN ' port7' THEN ' Port 07 STUDIO' WHEN ' port8' THEN ' Port 08 Unused' WHEN ' port9' THEN ' Port 09 WIRELESS' WHEN ' port10' THEN ' Port 10 PAYMENTS' WHEN ' port11' THEN ' Port 11 Unused' WHEN ' port12' THEN ' Port 12 Unused' WHEN ' port13' THEN ' Port 13 DMZ' WHEN ' port14' THEN ' Port 14 MANAGEMENT' WHEN ' port15' THEN ' Port 15 LAN' WHEN ' port16' THEN ' Port 16 INTERNET' ELSE `srcintf` END) AS src_intf, (CASE `dstintf` WHEN ' port1' THEN ' Port 01 Unused' WHEN ' port2' THEN ' Port 02 Unused' WHEN ' port3' THEN ' Port 03 Unused' WHEN ' port4' THEN ' Port 04 Unused' WHEN ' port5' THEN ' Port 05 Unused' WHEN ' port6' THEN ' Port 06 Unused' WHEN ' port7' THEN ' Port 07 STUDIO' WHEN ' port8' THEN ' Port 08 Unused' WHEN ' port9' THEN ' Port 09 WIRELESS' WHEN ' port10' THEN ' Port 10 PAYMENTS' WHEN ' port11' THEN ' Port 11 Unused' WHEN ' port12' THEN ' Port 12 Unused' WHEN ' port13' THEN ' Port 13 DMZ' WHEN ' port14' THEN ' Port 14 MANAGEMENT' WHEN ' port15' THEN ' Port 15 LAN' WHEN ' port16' THEN ' Port 16 INTERNET' ELSE `dstintf` END) AS dst_intf, sum(coalesce(`rcvdbyte`,0)) as total_recvd_bytes, sum(coalesce(`sentbyte`,0)) as total_sent_bytes, sum(coalesce(`rcvdbyte`,0)+coalesce(`sentbyte`,0)) as total_bytes from $log where $filter and (`srcintf` = ' port16' OR `dstintf` = ' port16' ) group by src_intf, dst_intf order by src_intf