I would like a quick and dirty way to process SMF Type 119, Subtype 2 records (TCP termination) with the following results. I want to
1) Filter on only Type 119, Subtype 2 records for a specific date.
This part works fine.
2) I want the output to be only one record with two fields, the sum of location 205, 8 bytes binary the sum of location 218, 8 bytes binary. These are the Inbound and Outbound byte counts for each connection.
I cannot get the SUM FIELDS to yield just one output record.
The mapping from pacsys.com uses offsets, not starting location. The first field, SMF119LEN, is offset 0, but is at byte 1. Hence why I used 6 instead of 5 for type and 24 instead of 23 for subtype. i have verified that the selection criteria is correct by copying 200 records.