Good afternoon,

one our customer asked us a tool to monitor his ipsec site to site vpn tunnels, to gather realtime informations about bandwith usage and, if possible, understanding who's using most bandwith. 
I've tried first the ACC , but i did not find and realtime bandwith usage graph or monitor;
then i've tested Splunk , configuring as the syslog collector for all events generated by the Arkoon appliance and i was successfull : i can now see top 10 ip sources/destinations and protocols  for a particular subnet
I was trying to get my result using SNMP events to Splunk to generate some graphs based on ip address but i could not get through. 

ANY kind of help would be REALLY appreciated! :)