Is there a way to get Sum BytesSent by IP?

[splunkcol]

I need to get the list of the IPs that have generated the most outgoing traffic.

When the query is generated I find that there are multiple records for the same IP.

Is there any way to get a total of GB for each IP?

Thank you

[gcusello · Accepted solution]

Hi @splunkcol,

are you speaking of the same source IP I suppose, so you could run something like this:

index=your_index
| stats sum(GB) as GB by SourceIP
| sort -GB

Ciao.

Giuseppe

[yuanliu]

Instead of "count by GB, SourceIP, DestinationIP", do

| stats sum(GB) as GB count by SourceIP DestinationIP