How to edit my stats search to get a sum of bytes per app and total sum for all traffic?

[ethanrulez80]

I currently get events that shows bytes received from a router. What I'm trying to do is use stats to obtained a sum of all traffic, then categorize traffic by apps.

Example:

Table:

| Sum of Bytes        | 999
| Sum of Http Bytes   |  89
| Sum of VoIP Bytes   | 910

What my search looks like:

index=* | stats sum(Bytes) ,sum(Bytes) where [interface]="A" , sum(Bytes) where [interface]="B"

[somesoni2 · Accepted solution]

Try like this

your base search | stats sum(Bytes) as Bytes by interface | addcoltotals labelfield=interface label="All Interfaces"