Dear Experts,
Request you help to convert this below query into tstats query.
index=network_proxy category="Personal Network Storage and Backup" | eval Megabytes=(((bytes_out/1024)/1024))| stats sum(Megabytes) as Megabytes by user dest_nt_host |eval Megabytes=round(Megabytes,3)| sort -Megabytes| fields user dest_nt_host Megabytes|head 10
Converting into tstats
(| tstats count from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup" ) (Web.user!="LDAP*") by Web.user ) help required to how to do this.
Thanks in advance.
I don't have this Datamodel to test with, but the query you are looking for should be close to this.
| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes
I don't have this Datamodel to test with, but the query you are looking for should be close to this.
| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes