I have recently setup/enabled some zone protection on one of my interfaces. I have set the values high since I have no way of knowing how much data is actually passing the interface and what threshold would trigger the dropping. Now that its running I know I can run the following command "show zone-protection zone untrust" to see the current count of packets passing and or dropped. What I'm wondering is if anyone has a good way of pulling all that data in over a course of a week or month, so that I can see the trending numbers to adjust my zone protection. I'm currently running splunk on our network for logging. Any help would be appreciated. Thank you
