https://community.splunk.com/t5/Splunk-Search/how-to-show-top-talker-information-based-on-the-CSV-file/m-p/62324#M15400 <P>HI,</P> <P>Im very new to Splunk, i still learning to get splunk work to provide a high level report to the management to review. I have the data extracted from a csv file below. I would like to show the top talkers based on the IP address given below by adding both the byte_sent and byte_receive. How can i do this?</P> <P>22/08/2011 21:38:59,IP-64.236.16.139,2263,7<BR /> 22/08/2011 21:38:59,IP-64.128.203.22,115748,86</P> <P>2263 is the byte_sent while 7 is the byte_received.<BR /> 115748 is the byte_sent while 86 is the byte_received. </P> Mon, 28 Sep 2020 09:49:19 GMT tailesley 2020-09-28T09:49:19Z https://community.splunk.com/t5/Splunk-Search/how-to-show-top-talker-information-based-on-the-CSV-file/m-p/62324#M15400 <P>HI,</P> <P>Im very new to Splunk, i still learning to get splunk work to provide a high level report to the management to review. I have the data extracted from a csv file below. I would like to show the top talkers based on the IP address given below by adding both the byte_sent and byte_receive. How can i do this?</P> <P>22/08/2011 21:38:59,IP-64.236.16.139,2263,7<BR /> 22/08/2011 21:38:59,IP-64.128.203.22,115748,86</P> <P>2263 is the byte_sent while 7 is the byte_received.<BR /> 115748 is the byte_sent while 86 is the byte_received. </P> Mon, 28 Sep 2020 09:49:19 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-top-talker-information-based-on-the-CSV-file/m-p/62324#M15400 tailesley 2020-09-28T09:49:19Z https://community.splunk.com/t5/Splunk-Search/how-to-show-top-talker-information-based-on-the-CSV-file/m-p/62325#M15401 <P>There are few ways to do this: </P> <UL> <LI><P>You can extract and name the fields using a Interactive Field Extractor included into Splunk. Here you can find link to documentation page and video:</P> <UL> <LI><A href="http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample">http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample</A></LI> <LI><A href="http://www.splunk.com/view/SP-CAAADUY">http://www.splunk.com/view/SP-CAAADUY</A></LI> </UL></LI> <LI><P>You can use the Field Extractor App: </P> <UL> <LI><A href="http://splunk-base.splunk.com/apps/22291/field-extractor">http://splunk-base.splunk.com/apps/22291/field-extractor</A><BR /></LI> </UL></LI> <LI><P>You can extract your fields using configuration files, like described here: </P> <UL> <LI><A href="http://splunk-base.splunk.com/answers/13580/teach-splunk-42-to-identify-positions-in-a-csv-file">http://splunk-base.splunk.com/answers/13580/teach-splunk-42-to-identify-positions-in-a-csv-file</A></LI> </UL></LI> </UL> Tue, 23 Aug 2011 08:23:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-show-top-talker-information-based-on-the-CSV-file/m-p/62325#M15401 mzorzi 2011-08-23T08:23:02Z