@jababin...Glad that it worked 🙂 ... View more

Easy peasy yoursearchhere | stats sum(bytes) as totalBytes by Client, Server | sort 10 -totalBytes will return a list of the "top 10" Client-Server combinations based on the sum. If you want the top 5 plus "other", try this yoursearchhere | stats sum(bytes) as totalBytes by Client, Server | eventstats sum(totalBytes) as grandTotal | sort 5 -totalBytes | appendpipe [ stats sum(totalBytes) as top5 avg(grandTotal) as grandTotal | eval Client="Other" | eval Server="Other" | eval totalBytes = grandTotal - top5 ] | eval percent = round(totalBytes*100/grandTotal,1) | fields - top5 grandTotal Add the "Other" is clearly a little more tricky. ... View more

Thanks, it's right that I did not need CNT_OK, and could filter directly on MAX after stats! ... View more