https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156520#M44031 <P>How about this?</P> <PRE><CODE>sourcetype=mynetworkdata | stats sum(sent_bytes) as send sum(rcvd_bytes) as receive by src_ip_addr (column 1) | sort - send,receive | head 5 </CODE></PRE> Mon, 28 Jul 2014 12:23:37 GMT somesoni2 2014-07-28T12:23:37Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156517#M44028 <P>I'm blocking.</P> <P>I would like to appear in the form of a graph or table, the number of bytes that my top 5 IP addresses consume. I do not understand exactly what is meant by the "count" in variable "sent" to fortigate log. Have you any idea?</P> Thu, 24 Jul 2014 18:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156517#M44028 pierra56 2014-07-24T18:10:26Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156518#M44029 <P>You're looking for a search query to get the information which can be used in form of table graph? (the command line in the question is just confusiong). </P> <P>Have a look at this as well. <A href="http://answers.splunk.com/answers/138212/top-10-ip-along-w-top-4-ports">http://answers.splunk.com/answers/138212/top-10-ip-along-w-top-4-ports</A></P> Thu, 24 Jul 2014 18:44:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156518#M44029 somesoni2 2014-07-24T18:44:42Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156519#M44030 <P>I was with you until you started asking about "count", as that comes with no context. The first part of your question is probably:</P> <PRE><CODE>sourcetype=mynetworkdata | stats sum(bytes) as bytes by src_ip_addr | sort - bytes | head 5 </CODE></PRE> Sat, 26 Jul 2014 14:08:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156519#M44030 gkanapathy 2014-07-26T14:08:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156520#M44031 <P>How about this?</P> <PRE><CODE>sourcetype=mynetworkdata | stats sum(sent_bytes) as send sum(rcvd_bytes) as receive by src_ip_addr (column 1) | sort - send,receive | head 5 </CODE></PRE> Mon, 28 Jul 2014 12:23:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156520#M44031 somesoni2 2014-07-28T12:23:37Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156521#M44032 <P>Thx for your response. <BR /> I would like to add another column. It is the separator to use ? this "|" <BR /> for exemple:<BR /> sourcetype=mynetworkdata |<BR /> stats sum(sent_bytes) as send by src_ip_addr (column 1) | sort - send <BR /> stats sum(rcvd_bytes) as receive by src_ip_addr (column 2) | sort - receive <BR /> | head 5</P> Mon, 28 Sep 2020 17:11:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-number-of-bytes-sent-received-by-top-5-IP/m-p/156521#M44032 pierra56 2020-09-28T17:11:16Z