https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460111#M129801 <P>any problem?<BR /> looks like it works.</P> Mon, 03 Feb 2020 09:54:22 GMT to4kawa 2020-02-03T09:54:22Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460110#M129800 <P>Hi. I'm new to splunk and trying to code a search for top 30 applications by bandwidth. So far I have the following coding and wondering if anyone has any ideas on how I can get it to work. I have put an '*' in my index as it's classified. I would like it in a table. </P> <PRE><CODE>index=* sourcetype=*=* OR * | eval byteReceivedMB=round(rcvdbyte/1024/1024,2) | eval byteSentMB=round(sentbyte/1024/1024,2) | stats sum(byteReceivedMB) as "Megabytes Received" sum(byteSentMB) as "Megabytes Sent" by app | addtotals | dedup app | sort limit=30 -Total </CODE></PRE> Mon, 03 Feb 2020 02:35:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460110#M129800 annageorgiou 2020-02-03T02:35:10Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460111#M129801 <P>any problem?<BR /> looks like it works.</P> Mon, 03 Feb 2020 09:54:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460111#M129801 to4kawa 2020-02-03T09:54:22Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460112#M129802 <P>Make sure there is a space between the <CODE>-</CODE> and the fields that are to be sorted descending. Otherwise, Splunk has a tendency to think that <CODE>-Total</CODE> is the name of the field it is supposed to sort on. </P> Mon, 03 Feb 2020 17:54:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460112#M129802 DalJeanis 2020-02-03T17:54:31Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460113#M129803 <P>Thank you. Played around with the total and the spacing and it works. </P> <P>I had to change the coding above to show:-</P> <P>index=*<BR /> | eval TotalMB=round((TotalSent+TotalRcvd)/1024/1024,2) <BR /> | eval TotalGB=round(TotalMB/1024,2) <BR /> | stats sum(sentbyte) AS TotalSent, sum(rcvdbyte) AS TotalRcvd by app<BR /> | addtotals <BR /> | dedup app <BR /> | sort limit=30 - total</P> <P>This is giving me some sent and received responses. Hopefully it's correct. </P> Mon, 03 Feb 2020 22:20:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460113#M129803 annageorgiou 2020-02-03T22:20:09Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460114#M129804 <P>I had to change the coding above to show:-</P> <P>index=*<BR /> | eval TotalMB=round((TotalSent+TotalRcvd)/1024/1024,2) <BR /> | eval TotalGB=round(TotalMB/1024,2) <BR /> | stats sum(sentbyte) AS TotalSent, sum(rcvdbyte) AS TotalRcvd by app<BR /> | addtotals <BR /> | dedup app <BR /> | sort limit=30 - total</P> <P>This is giving me some sent and received responses. Hopefully it's correct. I had to change the spacing for total as menitoned in the below answer.</P> Mon, 03 Feb 2020 22:21:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460114#M129804 annageorgiou 2020-02-03T22:21:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460115#M129805 <P>index= *<BR /> | eval TotalMB=round((TotalSent+TotalRcvd)/1024/1024,2) <BR /> | eval TotalGB=round(TotalMB/1024,2) <BR /> | stats sum(sentbyte) AS TotalSent, sum(rcvdbyte) AS TotalRcvd by app<BR /> | addtotals <BR /> | dedup app <BR /> | sort limit=30 - total</P> <P>In the end, I had to use this coding and it seems to work. Sorry above 'eval' coding (in my original question) didn't work.</P> Mon, 03 Feb 2020 22:46:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-top-30-applications-by-bandwidth/m-p/460115#M129805 annageorgiou 2020-02-03T22:46:07Z