I am trying to find the total bytes usage by user/ip - I have in the index the various clientip and the bytes usage on a specific moment. The result of my search would report for each user/ip the total bytes based on the various preset time
Hi there, try with this
main search | stats sum(bytes_field) by User IP
