Splunk Search

Is there a way to get Sum BytesSent by IP?

splunkcol
Builder

I need to get the list of the IPs that have generated the most outgoing traffic.

When the query is generated I find that there are multiple records for the same IP.

Is there any way to get a total of GB for each IP?

Thank you

splunkcol_0-1657318307441.png

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

are you speaking of the same source IP I suppose, so you could run something like this:

index=your_index
| stats sum(GB) as GB by SourceIP
| sort -GB

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunkcol,

are you speaking of the same source IP I suppose, so you could run something like this:

index=your_index
| stats sum(GB) as GB by SourceIP
| sort -GB

Ciao.

Giuseppe

yuanliu
SplunkTrust
SplunkTrust

Instead of "count by GB, SourceIP, DestinationIP", do

| stats sum(GB) as GB count by SourceIP DestinationIP

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...