issue with Splunk query

[su_kumar]

Hi,

issue is in writing correct a query

Example:

Let's assume I have 2 groups such as :

 Group                User                    Application         bandwidth

================================================================

1)Group 1 :

             user 1 : 
                            App1 :                 25Mbs
                            App2 :             15Mbs

            user 2:
                            App1 :             25Mbs
                            App2 :             10Mbs

            user 3:
                            App1 :          20Mbs
                            App2 :          5Mbs

---

Total Group 1 usage : 100 Mb (Appl1: 70 Mbs, Appl2: 30 Mbs)

2)Group 2 :
user 4,

user 5,
user 6

similarly i have Group2, Group3 .......

Here, Group1 has 3 users( user1 , user2, user2) and
user1 usage 40 MB (for App1:25MB and App2:15MB) ,
user2 usage 35 MB (APP1 :25MB and App2:10MB)
User3 usage 25MB(APP1:20MB and APP2:5MB).

I want to display in Group usage per user information and total usage group1 , group2 ..
write Query :

| dedup user_id | sort department,user_id
| stats list("User") as user,list("Application") as Application,list("bandwidth") as Bandwidth_used by Group
| streamstats count as serialno
| appendpipe [|stats max(serialno) sum(bandwidth) as Bandwidth_used by department
| eval Group=Group." Total"] | sort serialno | fields - serialno

issue : how to modify above query..
1: unable to get total bandwidth for each Group1 , group2 .... here Total is showing 1,2,3,4...
how to show the top 10 applications being used by each user.

2: The values of usage per group total shall be shown at the top of the page instead of the end. .