Top by a value inside the query

[timbCFCA]

Within each record in a query I have two fields, c_ip and cs_bytes which is numeric. How can I get the top 10 c_ip values for the highest sum total of the cs_bytes field? The direction I've tried is a stats sum(cs_bytes) by c_ip.

[Stephen_Sorkin · Accepted solution]

You can search:

... | stats sum(cs_bytes) as bytes by c_ip | sort - bytes | head 10