Trying to search a connections log, top 10 hosts sending the most traffic, doesn't seem to be working.

[howardsamuels]

Trying to search a connections log, top 10 hosts sending the most traffic, need some help, thanks.

[DEAD_BEEF]

index=your_index | stats count by host sum(bytes_out) AS "Bytes Out" | sort -count limit=10

[DalJeanis]

@howardsamuels - The general answer to this type of question is

1) Find a single record of the type you want
2) craft a stats query to add it up the way you want it.

However, @niketnilay has provided three other viable methods, depending on what you are trying to achieve and what information is on your system.

The first thing to do is to specify what, exactly, you want to know.

[niketn]

@howardsamuels, for the community to assist you, you definitely need to add more details like what is the current search you have tried? What does your data look like in connections log? What does most traffic refer to (more no of events or more amount of data based on size)?

If your host ingests data to Splunk index, can you use metadata, tstats or eventcount command to get the number of events per host?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventcount
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats