how to define more values in sflow-rt using REST API

[Habtamu Molla]

How are you dear peter? i need to define more than one values, like belows,                              flow = {
    'keys': 'ipsource,ipdestination,tcpsourceport,tcpdestinationport',

    'value': 'frames',

     'values':'count:ipsource,avg:duration',

    'log': True

}

when i try to access the values, it brings KeyError: 'values' errors.

my question is , is that possible to define more than one values using REST API in sflow-rt?

if it is possible show me as example with more apologize dear?

[Peter Phaal]

What version of sFlow-RT are you using? The ability to set multiple values is a fairly recent addition. I just tested the latest version and the following worked:

curl -X 'PUT' \
  'http://10.0.0.183:8008/flow/values/json' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -d '{

    "keys": "ipsource,ipdestination,tcpsourceport,tcpdestinationport",
    "value": "frames",

     "values":"count:ipsource,avg:bytes",
    "log": true
}'

Your definition wouldn't generate any flows because duration isn't a value associated with packet samples (each sample represents a point in time and has no duration). The duration field applies to WiFi retransmit times, http response times (from sFlow agent embedded in web servers), etc.

Also, some values may be misleading in the logged flow records since they represent the value at the time the flow was logged. If the log event was an idle timeout then most values will be zero since there is no data in the t: window at the time the record was logged. These extra values are most useful when you are looking at active flows.

[Habtamu Molla]

thanks you dear peter for your help and fast response! i am using the latest sflow-rt which is available in the sflow-rt website download tab as tar.gz file.

besed on your suggestion that is solved, thanks you dear

[Habtamu Molla]

how are you dear peter?

i need to send flow rules  that can do adding flow rules to send to its destination or dropping the flow entries based on sflow-rt program or event outputs.  let me tell you a little hint, i am doing a program that identify the whether the flow is an attack or not.

if the program output display the flow is an attack i need to send flow rule that can drop the flow entry, otherwise i need to send flow rules that can forward flow to its destination.

these flow rules are must be send from sflow-rt to ryu controller using REST API to control the openVswitch flow tables since ryu has  REST API apps that can help to do such things.

Therefore, my question is, how can i  do this?

have you any supportive materials that can help me to achieve the above ideas?

Thanks dear, sorry for my long and continuous question

i am proud by your continuous help

On Friday, June 16, 2023 at 5:20:13 PM UTC+3 peter...@gmail.com wrote: