See my MikroTik to Splunk project here:
http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/1
It uses IP Accounting on MikroTik and sends data using Sylog to Splunk to Graph the data.
See screenshot of MikroTik traffic in post 2.
You can easy see whats eating bandwidth, when its used etc.