I have had a quick look through the MySQL database that NetFlow logs to and can see the interface speed, but current traffic seems to be held within the "raw" tables.  I understand that the exact raw table name will depend upon the time we're interested in, but can someone guide me on how to combine the data held within them into some simple transmit/receive/total figures?

Ideally I'd like a "latest snapshot" figure (last 5 minutes or whatever is feasible), as well as an "average last hour" figure.  These two figures should give the engineers an overview of what the link is doing and whether any surge in traffic is a blip or has been ongoing for a period of time.

I can probably do the donkey work, I just need some help working out which fields mean what and how to interpret them.  Any help would be hugely appreciated.